The API returns fields you never meant to send
Broken Object Property Level Authorization

A normal user signs up, logs in, and loads their profile page with the dev tools open.

1. 1
   Read the leak

   The /api/me response has 40 fields. Most are boring. Three are not: role, stripeCustomerId, and passwordResetToken. The attacker copies them.
2. 2
   Turn the leak into a write

   They notice the app also has PATCH /api/me for updating display name and avatar. They send the same endpoint with { "role": "admin" } in the JSON body. The response comes back 200 OK with role: "admin".
3. 3
   Walk through the front door

   They refresh the page. The admin panel renders because the frontend trusts the role field. Every admin-only endpoint now returns real data because the backend also trusts it.

The attacker escalated from signup to admin in three HTTP requests, and never touched a single exploit. The root cause is a spread operator the model wrote because the prompt said 'update the user.'

// app/api/me/route.ts
export async function GET(req) {
  const session = await getSession(req);
  const user = await db.user.findUnique({ where: { id: session.userId } });
  return Response.json(user); // every column, including role and secrets
}

export async function PATCH(req) {
  const session = await getSession(req);
  const body = await req.json();
  const updated = await db.user.update({
    where: { id: session.userId },
    data: body, // attacker sends { role: 'admin' }, server obeys
  });
  return Response.json(updated);
}

// app/api/me/route.ts
import { z } from 'zod';

const PublicUser = z.object({
  id: z.string(),
  email: z.string(),
  name: z.string().nullable(),
  avatarUrl: z.string().nullable(),
});

const UpdateUser = z.object({
  name: z.string().max(120).optional(),
  avatarUrl: z.string().url().optional(),
});

export async function GET(req) {
  const session = await getSession(req);
  const user = await db.user.findUnique({ where: { id: session.userId } });
  return Response.json(PublicUser.parse(user));
}

export async function PATCH(req) {
  const session = await getSession(req);
  const data = UpdateUser.parse(await req.json());
  const updated = await db.user.update({ where: { id: session.userId }, data });
  return Response.json(PublicUser.parse(updated));
}

Two schemas: one for 'what the public sees' and one for 'what the owner can change.' Everything that is not in the allow list is dropped. Validation is not for formatting — it is the authorization boundary between the database and the API.