Will It Vibe?Route handler accepts a raw dict body instead of a Pydantic model
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
A route parameter is typed as a bare dict/Dict in a file that otherwise defines Pydantic BaseModel classes for its other routes, so this one handler skips FastAPI's automatic request validation and receives whatever shape the client sends. Heuristic: some endpoints (webhooks, generic proxies) legitimately need an untyped payload, so confirm before changing it.
Why it matters
A route parameter typed as a bare dict skips FastAPI's automatic request validation entirely: any JSON object the client sends is accepted, with no check on required fields, types, or ranges. In a codebase that otherwise defines Pydantic models for its other endpoints, this handler is the one place a malformed or unexpected payload reaches your code unchecked, which tends to surface as a confusing runtime KeyError or TypeError deep inside the handler instead of a clean 422 at the boundary.
How to fix it
Define a Pydantic model for the expected shape of the body and use it as the parameter type instead of dict, matching the pattern the rest of the file already uses. If the endpoint genuinely needs to accept an arbitrary, unstructured payload (a generic webhook receiver, for example), leave it as dict but add explicit validation of the specific fields you actually read out of it before using them.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo