Server-side validation mirrors client-side; crafted POST returns 400 not 500

Client-side validation is advisory — any attacker with curl can bypass it entirely. Without server-side enforcement on every field, a crafted POST with a missing title or malformed email doesn't get rejected at 400; it either crashes the handler with a 500 (leaking stack traces) or silently inserts garbage into your database. OWASP A03 (Injection) and CWE-20 (Improper Input Validation) both call this out as a critical failure mode: the server is the only trust boundary that matters.

Add a Zod schema in your API route and call .parse() before touching the database. Any ZodError returns a structured 400; all other errors stay as 500. In app/api/listings/submit/route.ts:

import { z } from 'zod'

const submissionSchema = z.object({
  title: z.string().min(10).max(200),
  description: z.string().min(50).max(5000),
  contactEmail: z.string().email(),
  category: z.string().min(1)
})

export async function POST(req: Request) {
  const body = await req.json()
  const result = submissionSchema.safeParse(body)
  if (!result.success) {
    return Response.json({ error: 'Validation failed', issues: result.error.issues }, { status: 400 })
  }
  // proceed with result.data
}