rules-trpc

Potentially unsafe pattern detected in trpc code: "unstable_concat". Review the use case — this may indicate a security risk, a deprecated API, or a misconfiguration. Confirm the write is intentional.

You are using an outdated API for trpc. Please upgrade to the newer API.

RISK: Exposing a tRPC router via createNextApiHandler or fetchRequestHandler without a createContext that attaches session/auth info means auth middleware has no context to check — all procedures effectively run unauthenticated. FIX: always pass a createContext factory that reads the session (e.g., getServerSession) and surfaced it to protectedProcedure middleware.

RISK: A tRPC mutation with no input schema accepts any caller-supplied payload without validation — every field is implicitly 'any', enabling injection of unexpected types, objects, or oversized payloads (CWE-20). FIX: always define an 'input: z.object({...})' schema so Zod validates and strips unknown keys before the handler runs.

RISK: Using publicProcedure (unauthenticated) for operations that modify data, access user records, or handle secrets bypasses authentication entirely — any unauthenticated caller can invoke these. FIX: use a protectedProcedure (with middleware that verifies a session/JWT) for any write or sensitive-read operation.