> If this were some custom format rather than json and the parser still used sscanf, the bug would still happen. So I think json is somewhat orthogonal to the matter.

What's the point of using standard formats if you're not taking advantage of off-the-shelf software for handling it?