name	input-validation
description	Validate and constrain untrusted input at the boundary. Use on any handler that accepts external data.
when_to_use	request bodies, query params, file uploads, webhook payloads, form data

Input Validation

Validate at the edge, before the data touches logic or storage.

Schema — type, required fields, allowed values. Reject unknown fields rather than ignoring them.
Bounds — string length, number ranges, array size. An unbounded input is a DoS and a memory bomb.
Format — emails, UUIDs, dates parsed and re-validated, not trusted as strings.
Files — size limit, type allowlist (check content, not just extension), no path traversal in names.
Reject with a clear 4xx and a message that says what's wrong — without leaking internals. Never trust "it comes from our own frontend". The request can come from anywhere.

Más de este repositorio

mismo repositorio

adversarial-verify

YaoYinYing/REvoDesign

Review a diff against the goal spec assuming the code is BROKEN. The reviewer that lives in the maker's head always agrees with itself — this pulls review into a hostile, separate pass. Invoke after every code change before marking work done.

2026-07-122

authz-check

YaoYinYing/REvoDesign

Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.

2026-07-122

bisect-regression

YaoYinYing/REvoDesign

Find the exact commit that introduced a bug. Use when something worked before and broke, and you don't know which change did it.

2026-07-122

changelog-from-diff

YaoYinYing/REvoDesign

Turn a set of commits or a diff into a clean, user-facing changelog entry. Use before a release or PR description.

2026-07-122

clean-commits

YaoYinYing/REvoDesign

Turn messy WIP into clean, atomic commits with messages that explain why. Use before opening a PR.

2026-07-122

context-budget

YaoYinYing/REvoDesign

Keep the agent's context lean so accuracy doesn't collapse. Use on long sessions, big files, or when the agent starts hallucinating.

2026-07-122

name	input-validation
description	Validate and constrain untrusted input at the boundary. Use on any handler that accepts external data.
when_to_use	request bodies, query params, file uploads, webhook payloads, form data

Input Validation

Validate at the edge, before the data touches logic or storage.

Schema — type, required fields, allowed values. Reject unknown fields rather than ignoring them.
Bounds — string length, number ranges, array size. An unbounded input is a DoS and a memory bomb.
Format — emails, UUIDs, dates parsed and re-validated, not trusted as strings.
Files — size limit, type allowlist (check content, not just extension), no path traversal in names.
Reject with a clear 4xx and a message that says what's wrong — without leaking internals. Never trust "it comes from our own frontend". The request can come from anywhere.