highUser input reaching your database or shell

Request Body Saved Straight to the Database

Everything the client sends is written to the database as-is.

Why it matters

Whoever calls this endpoint decides which fields get saved. If your users table has a role, isAdmin, credits or ownerId column, a request can set it. This is how a normal account becomes an admin account, or how an order gets a price of zero, with no bug on your side other than trusting the whole body.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Mongoose create with the whole body
app.post('/api/users', async (req, res) => {
  const user = await User.create(req.body);
  res.json(user);
});

The smallest fix

minimal patch
// Pick the fields you expect instead of saving the whole body:
const { name, email } = req.body;
await User.create({ name, email });

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
// Validate the shape too, so bad types and extra fields are rejected:
import { z } from 'zod';
const CreateUser = z.object({
  name: z.string().min(1).max(100),
  email: z.string().email(),
}).strict();
const data = CreateUser.parse(req.body);
await User.create(data);

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number], the request body is passed straight into a database write: [the flagged code]. Replace it with an explicit object that only contains the fields this endpoint is meant to accept, and validate those fields with a schema (for example Zod). Make sure fields like role, isAdmin, ownerId or price cannot be set by the caller.

How to check the fix worked

1. Send a request that includes an extra field such as role: "admin" and
   confirm it is ignored or rejected.
2. Send a request with the wrong type for a field and confirm a 400.
3. Send a valid request and confirm only the expected fields are saved.

Further reading