GPT-5 finding
JSON parsing errors are not handled in secrets POST/DELETE, returning 500 instead of 400
mediumapi-contracthigh
- dashboard/app/api/secrets/route.ts:101
- dashboard/app/api/secrets/route.ts:129
await request.json() can throw on invalid JSON or missing/incorrect Content-Type. The code does not catch this, so the route likely returns a 500 rather than a 400 with a helpful message.
Recommendation
Wrap request.json() in try/catch (or use .catch) and return 400 on parse failure. Optionally validate Content-Type: application/json.