Validation schemas have at least one runtime use

Declaring a Zod or Joi schema and never calling .parse() on it is the canonical AI security theater move — the schema exists only as a type alias, and your API accepts arbitrary JSON at runtime. OWASP A03 (Injection) and A04 (Insecure Design) are the direct mappings: without a parse call, mass-assignment attacks, prototype pollution via crafted payloads, and type coercion exploits all reach your database unchecked. If a breach occurs and an auditor finds schemas that were never enforced, the liability argument becomes 'you knew the controls were needed but shipped them as decoration.'

Wire each exported schema into a .parse() or .safeParse() call at the route entry point. The schema and the parse call must be in the same request path — a type declaration elsewhere doesn't count.

// src/app/api/users/route.ts
import { CreateUserSchema } from '@/lib/schemas'

export async function POST(req: Request) {
  const body = await req.json()
  const data = CreateUserSchema.parse(body)  // throws ZodError on bad input
  const user = await prisma.user.create({ data })
  return Response.json(user, { status: 201 })
}

For tRPC routes, use .input(Schema) on the procedure. For Server Actions, use parseWithZod or safeAction. Search for every exported schema name in your source tree and confirm at least one call site exists.