User input is validated before use

A route handler that does const body = await request.json() and passes the result straight to Prisma, Supabase, or a raw SQL call is trusting whatever the client sends — including type mismatches, unexpected fields, oversized payloads, and deliberately malformed structures. Without a schema parse in front, attackers can submit extra fields that the ORM happily writes (mass-assignment), coerce types to trigger errors that leak stack traces, or send payloads large enough to DoS the JSON parser. AI coding tools consistently skip this step — they'll generate a handler that destructures the request body, use the fields immediately, and move on, because the happy path works and validation adds visible line count. Zod / Yup / Valibot / Pydantic aren't hard to add; they just get forgotten.

Define a Zod schema and parse at the top of every handler:

const Body = z.object({ email: z.string().email(), name: z.string().min(1).max(120) })
const body = Body.parse(await request.json())
// use body.email, body.name

Deeper remediation guidance and cross-reference coverage for this check lives in the security-hardening Pro audit — run that after applying this fix for a more exhaustive pass on the same topic.

• ID: project-snapshot.injection.user-input-validated
• Severity: high
• What to look for: Enumerate every API route handler / route handler / server action / form action in the project. For each, check whether the request body, query params, or form data are parsed through a validation library (Zod, Yup, Joi, Valibot, ArkType, class-validator, Pydantic, etc.) BEFORE being used. Count handlers with validation vs. handlers without.
• Pass criteria: At least 80% of handlers that consume request data validate it through a recognized library before use, AND no handler that writes to a database uses unvalidated input.
• Fail criteria: Less than 80% validation rate, OR any database-writing handler skips validation.
• Skip (N/A) when: No API routes / server actions / route handlers detected (project is purely static).
• Do NOT pass when: Validation exists but runs AFTER the database write — the order matters. Also do not pass when only some fields are validated and the rest pass through as-is.
• Report even on pass: "Found N handlers that consume request data; M validate via {library list}. Validation rate: M/N = X%."
• Detail on fail: "4 of 12 API handlers parse request body without Zod/Yup validation; 1 of those writes to the database (app/api/comments/route.ts)".
• Remediation: Define a Zod schema and parse at the top of every handler:

  const Body = z.object({ email: z.string().email(), name: z.string().min(1).max(120) })
  const body = Body.parse(await request.json())
  // use body.email, body.name