Priyanka Nair

I treat YAML as a language where layout carries the meaning, and most of its bad reputation comes from people expecting a format with punctuation to delimit structure. Indentation defines nesting, so a file mixing tabs and spaces can parse in one tool and fail in another, and a parser that does not reject tabs may hand you a structure you did not intend. There is no reliable visual check. The block forms, where the indicator is given or explicit, exist because guessing indentation is ambiguous in a way that matters. Scoping has rules that catch newcomers. Anchors define a reusable node, aliases reference it, and the scope rules determine whether an alias may reach a node defined in another document or block. Merge keys fold mapping keys together, producing a flat result no single part of the document stated. Several documents can live in one file separated by a document marker, and many loaders read only the first. That is a common reason a configuration file appears to be ignored entirely. Values need quoting more often than people expect. Anything starting with an indicator character, anything containing a colon followed by a space, and anything resembling a date, a number or a sexagesimal will change type silently. Dates are worth singling out, because YAML has its own timestamp type and converting one into a local time changes what the value means. The security note is short and belongs at the top of any YAML page: a loader that constructs objects from untrusted input is a code execution bug waiting for input.