Validation schemas have at least one runtime use

A Zod schema exported but never called at runtime is not input validation — it is type decoration. The taxons placeholder-hygiene and injection-and-input-trust both apply: the AI wrote a schema to satisfy the appearance of security (OWASP A03: Injection), but the validation never executes, so arbitrary input reaches database writes, file operations, and downstream systems unchanged. CWE-20 (Improper Input Validation) is the direct mapping. This is the canonical AI security-theater pattern: the codebase looks hardened because schemas exist, but CreateUserSchema.parse() is never called on any entry-point body.

Call .parse() or .safeParse() on every schema at every entry point that receives external input. Type inference alone (z.infer<typeof Schema>) does nothing at runtime.

// src/app/api/users/route.ts
import { CreateUserSchema } from '@/lib/schemas'

export async function POST(req: Request) {
  const body = await req.json()

  // Bad: schema exists but is never invoked — arbitrary input passes through
  // const user = await db.user.create({ data: body })

  // Good: parse throws ZodError on invalid input before it reaches the DB
  const data = CreateUserSchema.parse(body)
  const user = await db.user.create({ data })
  return Response.json(user, { status: 201 })
}

For React forms: useForm({ resolver: zodResolver(CreateUserSchema) }). For tRPC procedures: .input(CreateUserSchema). For server actions: parseWithZod(formData, { schema: CreateUserSchema }). Every schema must have at least one call site that runs at runtime.