Input reaching the database unvalidated
Scan rule · RSC-SEC-060
- Security
- Severity: Medium
- CWE-20
- OWASP A03-2021
Traces request bodies that flow into an insert or update without schema validation (mass assignment).
Scan tier
- Source code from source maps
- Repo access (deep scan)
How to fix it
Parse input with a Zod schema and pass on allow-listed fields only.