Input Validation

Validate and sanitize all untrusted input using Zod v4 and Pydantic.

Overview

• Processing user input
• Query parameters
• Form submissions
• API request bodies
• File uploads
• URL validation

Core Principles

1. Never trust user input
2. Validate on server-side (client-side is UX only)
3. Use allowlists (not blocklists)
4. Validate type, length, format, range