Unsafe type escapes on external input
Part of the Engineering practices check · fix arrives as a guide
What it is
Values arriving from outside the process — request bodies, API responses, environment variables — are cast with as, asserted non-null with !, or typed as any rather than validated.
Why it matters
A type assertion is a promise to the compiler, not a check. The data does not have to match, and when it does not you get a confusing failure several frames away from the boundary where the wrong shape entered.
How to fix it
Parse external input with a schema validator at the boundary and let the validated type flow inward. One parse call at the edge removes the need for assertions everywhere downstream.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.