Skip to content

Scan rule · RSC-SEC-060

Input reaching the database unvalidated

SecuritySeverity: MediumCWE-20OWASP A03-2021

Traces request bodies that flow into an insert or update without schema validation (mass assignment).

Scan tier

Source code from source mapsRepo access (deep scan)

How to fix it

Parse input with a Zod schema and pass on allow-listed fields only.

Scan your own app for free