How is this different from missing validation?

Validation checks values; mass assignment is about keys. Even valid-looking requests can carry extra keys (role, plan) that your write happily persists unless you name the fields.

Can't I just validate the body with zod?

Yes, if you strip unknown keys (strict parsing or pick) and write the parsed result. Validating but then spreading the original body still lets extra fields through.

Explicit field mapping in every write, or strict schema parsing whose output — not the raw body — goes into the write.

C33

Input handling

Mass Assignment Check — Can Users Overwrite Fields They Never Saw?

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.

What the issue is

When a route writes the whole request body into a database record, a crafted request can set fields the form never showed — role, plan, credits — and escalate its own privileges on your server.

Why AI tools generate it

Passing the parsed body straight into a create or update is the shortest path AI tools write, and nothing breaks in testing — the extra fields only exist when an attacker adds them.

How DevMeth detects it

A code scan finds request bodies handed whole (or spread) into create, update, or upsert calls, and flags each write that doesn't name its fields.

C33

What a finding looks like

Critical

Request bodies are written straight into your database — users can overwrite fields they never saw

WHAT WE FOUND

C33 — masked sample

Sample — illustrative and masked exactly as a real report shows it. Run a free scan to see your own results.

The fix, in three steps

Name the exact fields each endpoint may write, or parse the body with a strict schema and write that — never spread raw request bodies into the database. Three steps.

Run a free scan and each finding carries a paste-ready fix prompt you can act on.

Try a free scan

FAQ

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.