In the video below, at time marker 21:40, the Microsoft PDC presenter says it's important that all JSON be wrapped so it's not a top level array:
https://channel9.msdn.com/Events/PDC/PDC09/FT12
What is the risk of an unwrapped top level array?
How should I check and see if I'm vulnerable? I purchase many components from 3rd parties and have external vendors who develop my code.