No input validation at route boundary

What it is

A route handler reads fields from the request body, query, or params without validating their type, shape, or bounds.

Why it matters

Everything downstream inherits the assumption that the data is well-formed. An unexpected type reaches a query builder or a filesystem call, and an unbounded value becomes a memory or cost problem before any business logic runs.

How to fix it

Validate at the boundary with a schema — Zod, Valibot, or equivalent — and reject with a 400 before the handler body runs. Include bounds, not just types: maximum lengths, array sizes, and numeric ranges.