No stub return values in non-trivial handlers
Why it matters
A handler whose body is only return Response.json({}) or return new Response() returns HTTP 200 without doing anything. The client accepts it as success, moves on, and logs no error. Orders never save, refunds never queue, webhooks never acknowledge — and the failure is invisible until a customer complains or a reconciliation job runs weeks later. This pattern ships constantly when AI scaffolds a route file it never finishes wiring.
Severity rationale
Medium because silent success on a non-health endpoint causes data loss without producing any observable error.
Remediation
Either implement the handler against the real data source or return an explicit 501 Not Implemented so clients see the gap. Never leave a stub that returns 200. Example at app/api/orders/route.ts:
export async function POST(req: Request) {
const order = await prisma.order.create({ data: await req.json() })
return Response.json(order, { status: 201 })
}
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the WIP-in-Production Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-slop-half-finished·automated