No hardcoded JSON fixture files loaded into handlers
Why it matters
A handler that imports ./fixtures/products.json and returns it pretends to be a real endpoint while serving static bytes. Data never updates, writes are impossible, and the client cache treats stale fixture data as authoritative. Because the response shape looks plausible, bugs hide for weeks until a user edits a record and the change silently disappears. Fixture-backed endpoints also bypass the database entirely, so inventory counts, pricing, and permissions drift from reality immediately.
Severity rationale
High because fixture-backed endpoints defeat every write path and make stale data indistinguishable from live data.
Remediation
Seed the fixture into the database once (for example from prisma/seed.ts) and have the handler query the database instead. Keep the JSON file under prisma/ or db/seed/ so its purpose is obvious. Fix the handler at app/api/products/route.ts:
import { prisma } from '@/lib/db'
export async function GET() {
const products = await prisma.product.findMany()
return Response.json(products)
}
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the WIP-in-Production Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-slop-half-finished·automated