A browser form passes every Constraint Validation API check. Which statement still holds …

A browser form passes every Constraint Validation API check. Which statement still holds at the server boundary?

1. The server must validate the submitted data independently.
2. The server may trust the data because browser validation cannot be bypassed.
3. The server only needs to repeat checks created with `setCustomValidity`.