Zod vs No Validation: What AI Code Skips and Why It Matters

The Problem: AI Trusts All Input

When you prompt an AI to "create an API route for user registration," the generated code destructures req.body immediately and uses the values directly. There is no type checking, no length validation, no format verification, and no sanitization. This is not a minor oversight - it is the single most common vulnerability in web applications.

The OWASP API Security Top 10 (2023) lists Broken Object Level Authorization and Unrestricted Resource Consumption as the top two API risks, both of which are directly enabled by missing input validation. According to Snyk's 2024 State of Open Source Security report, injection vulnerabilities remain the number one cause of security incidents in Node.js applications. A 2024 HackerOne report found that 73% of API vulnerabilities exploited in bug bounty programs involved improper input handling.

AI-Generated Route vs Validated Route

// ❌ BAD - AI-generated API route (no validation)
app.post('/api/users', async (req, res) => {
  const { name, email, age, role } = req.body;
  // No validation - accepts anything
  // name could be 10MB of text
  // email could be "not-an-email"
  // age could be -1 or "DROP TABLE users"
  // role could be "admin" (privilege escalation!)

  const user = await db.insert(users).values({ name, email, age, role });
  res.json(user);
});

// ✅ GOOD - Zod-validated API route
import { z } from 'zod';

const createUserSchema = z.object({
  name: z.string().min(1).max(100).trim(),
  email: z.string().email().max(255).toLowerCase(),
  age: z.number().int().min(13).max(150),
  // role is NOT accepted from input - set server-side
});

app.post('/api/users', async (req, res) => {
  const result = createUserSchema.safeParse(req.body);
  if (!result.success) {
    return res.status(400).json({
      error: 'Validation failed',
      details: result.error.flatten(),
    });
  }

  const { name, email, age } = result.data;
  // role is always 'user' - never from client input
  const user = await db.insert(users).values({
    name, email, age, role: 'user'
  });
  res.json(user);
});

What Happens Without Validation

Essential Zod Patterns for API Routes

import { z } from 'zod';

// String with constraints
const nameSchema = z.string().min(1).max(100).trim();

// Email with normalization
const emailSchema = z.string().email().max(255).toLowerCase();

// Enum to prevent arbitrary values
const roleSchema = z.enum(['user', 'editor']);

// Number with range
const ageSchema = z.number().int().min(0).max(150);

// UUID for IDs (prevents injection via ID fields)
const idSchema = z.string().uuid();

// Optional with default
const pageSchema = z.number().int().min(1).default(1);
const limitSchema = z.number().int().min(1).max(100).default(20);

// Strip unknown keys (prevents mass assignment)
const updateSchema = z.object({
  name: z.string().min(1).max(100).optional(),
  email: z.string().email().optional(),
}).strict(); // Rejects any keys not in the schema

Common Validation Mistakes

How to Add Validation to Your Project

1. Install Zod: npm install zod. Its bundle size is 13KB minified (no dependencies).
2. Create a schemas directory. Define one schema file per resource (users.schema.ts, posts.schema.ts).
3. Add middleware. Create a validate(schema) middleware that calls schema.safeParse(req.body) and returns 400 on failure.
4. Use .strict() on all schemas to reject unexpected fields and prevent mass assignment.
5. Infer TypeScript types from Zod schemas: type CreateUser = z.infer<typeof createUserSchema>. One source of truth for both runtime and compile-time types.
6. Scan for missing validation. VibeDoctor (vibedoctor.io) detects API routes that accept request body data without validation and flags them as medium-severity findings.

FAQ