Server-side input validation enforced

Client-side validation is a UX feature, not a security control — any attacker can submit arbitrary payloads directly to your API bypassing browser validation entirely. CWE-20 (Improper Input Validation) and OWASP A03 (Injection) both trace back to trusting unvalidated input on the server. NIST 800-53 SI-10 requires server-side input validation on all information system boundaries. Unvalidated inputs enable SQL injection, prototype pollution, type coercion bugs, and business logic bypasses. A quantity: -1 or role: 'admin' in a JSON body should never reach your business logic.

Apply Zod schema validation at the entry point of every API route before executing any business logic:

import { z } from 'zod'

const OrderSchema = z.object({
  productId: z.string().uuid(),
  quantity: z.number().int().min(1).max(100),
})

export async function POST(req: Request) {
  const body = await req.json().catch(() => null)
  const result = OrderSchema.safeParse(body)

  if (!result.success) {
    return Response.json(
      { error: 'Validation failed', details: result.error.flatten() },
      { status: 400 }
    )
  }
  // result.data is now type-safe
}

Apply this pattern consistently across all routes in src/app/api/. Server Actions that accept FormData also require validation — formData.get('quantity') returns string | null and must be parsed before use.