Always pass a sanitize_callback to register_setting(). Without one, anyone with the right capability can write arbitrary data into the option.
Match the callback to the data: sanitize_email, absint, esc_url_raw, or a custom function that validates against a whitelist.
For complex settings, validate the entire array — reject the whole submission if anything is wrong rather than silently dropping bad fields.