When adopting serverless technology, we eliminate the need to manage a server for our application. By doing so, we also pass some of the security threats to the cloud provider. We do not need to care about OS patching and configuration any more. It's all in the safe hands of the service providers. However, Serverless function still executes code. If written poorly, it can lead into a cloud disaster. One particular example is the injection attacks. Yes, injection attacks nothing new. But, what happens when there is no longer a perimeter? In this talk, I will examine the Serverless #1 risk: Event injection and will demonstrate injection attacks form multiple event types, such as emails, logs, files and even through Alexa.