Input validation on all endpoints

A single unvalidated endpoint — one handler that reads req.body.email directly into a database query without a validation step — is all an attacker needs to trigger injection (CWE-20, OWASP A03:2021), corrupt data with unexpected types, or crash the application with oversized inputs. OWASP A08:2021 (software and data integrity failures) also applies when schema-less input reaches business logic unguarded. TypeScript types do not enforce runtime shapes: JSON.parse gives you any, and type assertions are compile-time fiction.

Add runtime validation via Zod to every route handler that accepts input. Define schemas in src/lib/validations/ and import them into route files:

// src/lib/validations/user.ts
export const createUserSchema = z.object({
  email: z.string().email(),
  name: z.string().min(1).max(100),
})

// app/api/users/route.ts
const result = createUserSchema.safeParse(await req.json())
if (!result.success) {
  return apiError('VALIDATION_ERROR', result.error.message, 400)
}

Also validate path parameters — confirm that ID segments are valid UUIDs (z.string().uuid()) before using them in database queries. A validation schema is not optional polish; it is your first defense against injection and your contract with every caller.