refactor: replace security-validation.ts helpers with Zod schemas and a proper sanitization library

[coderabbitai]

Overview

src/server/utils/security-validation.ts contains a collection of ad-hoc runtime validation and sanitization helpers that duplicate functionality already provided by Zod (used at every tRPC boundary) or that apply insufficient security controls. This issue tracks replacing each function with the idiomatic, officially-recommended approach.

References:

• Next.js Data Security guide: https://nextjs.org/docs/app/guides/data-security
• OWASP Input Validation Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
• OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• Related PR: refactor #441

---

Functions & recommended replacements

1. validatePagination

Current problem: Duplicates pagination constraints that Zod can express declaratively. Called in many routers after the input has already been parsed by a Zod schema, making it a redundant second pass.

Recommendation: Express pagination constraints directly in each router's Zod input schema:

page: z.number().int().min(1).default(1),
limit: z.number().int().min(1).max(100).default(20),

This is consistent with the pattern already introduced in the updated GetPcListingReportsSchema in src/schemas/pcListing.ts. All routers (games.ts, listingReports.ts, pcListingReports.ts, pcListings/core.ts, listings/core.ts) should migrate to schema-level constraints and stop calling validatePagination.

---

2. validateEnum

Current problem: Called inside router procedure handlers after tRPC/Zod has already parsed and validated the input object. Any enum field that reaches this guard has already passed schema validation, so the check is a no-op under correct usage and masks a real schema gap if it is ever reached.

Recommendation: Move enum validation into the Zod input schema using z.nativeEnum() or z.enum([...]):

reason: z.nativeEnum(ReportReason),
status: z.nativeEnum(ReportStatus),

Per the Next.js Data Security guide, "Action arguments [should be] validated in the action or inside the Data Access Layer" — the tRPC Zod schema is exactly that boundary.

---

3. sanitizeInput

Current problem: Strips only <, >, javascript:, and on*= patterns. OWASP's Input Validation Cheat Sheet explicitly states that "denylisting can be useful as an additional layer of defense to catch some common malicious patterns, [but] should not be relied upon as the primary method." This regex is trivially bypassed and gives false confidence.

In practice:

• React already HTML-escapes all values rendered via JSX, preventing reflected XSS in the UI.
• Prisma uses parameterized queries, preventing SQL injection.
• For user-supplied text stored and later rendered as plain text, no sanitization is needed beyond what Prisma + React provide.
• For any field that will be rendered as HTML (e.g. rich-text descriptions), use a library purpose-built for the job, such as sanitize-html or DOMPurify (JSDOM variant for Node).

Recommendation:

1. Remove sanitizeInput calls from plain-text fields (notes, searchTerm, report descriptions) — React + Prisma cover those.
2. If any field is genuinely rendered as HTML, introduce a dedicated server-side sanitizer (e.g. sanitize-html) scoped to that field only.
3. Add a Content-Security-Policy header in next.config as a defence-in-depth layer per the OWASP CSP Cheat Sheet.

---

4. validateRequired

Current problem: Replicates what a non-optional Zod field already enforces. Currently used in user-pc-presets.repository.ts to assert that userId and name are present.

Recommendation: Ensure the repository is only called with data that has already been validated by a Zod schema (e.g. z.string().min(1)). If the repository must remain callable without a prior Zod pass, use TypeScript's type system (non-nullable types) so the compiler—rather than a runtime guard—enforces the constraint.

---

5. validateNonEmptyArray

Current problem: Duplicates z.array(z.string().uuid()).min(1) which Zod expresses in one line.

Recommendation: Replace the guard in games.ts with z.array(...).min(1) in the input schema for the bulkApprove/bulkReject procedures.

---

6. validateStringFormat + ValidationPatterns

Current problem: Used to assert UUID format for userId in user-pc-presets.repository.ts. Zod provides z.string().uuid() natively.

Recommendation: Validate UUID fields in the tRPC input schema (z.string().uuid()) so the error is surfaced at the API boundary, not deep inside the repository.

---

Suggested migration order

1. Update all Zod input schemas to encode pagination, enum, UUID, and non-empty-array constraints directly.
2. Remove all validatePagination, validateEnum, validateRequired, validateNonEmptyArray, validateStringFormat call sites.
3. Audit every sanitizeInput call site: remove where React + Prisma are sufficient; replace with sanitize-html where HTML rendering occurs.
4. Delete src/server/utils/security-validation.ts once no callers remain.
5. Add a CSP header in next.config as a complementary layer.

[Producdevity]

@coderabbitai make a PR resolving the issues that are described

[coderabbitai]

Coding Plan

Summary

• Consolidate all input validation into Zod schemas at the tRPC boundary, following the pattern already established in GetPcListingReportsSchema and GetListingReportsSchema
• Remove sanitizeInput calls entirely since React's JSX escaping and Prisma's parameterized queries provide sufficient protection for plain-text fields
• Trust TypeScript's type system and Zod schemas to enforce required fields, eliminating redundant runtime guards in repositories
• Delete the utility file once all call sites are migrated

Design Choices

Design Choice 1: CSP Header Implementation

Options Considered:

1. Add CSP header as specified in ticket
2. Skip CSP work since it already exists

Chosen Option: 2

Rationale: The existing CSP covers all recommended directives including script-src, style-src, connect-src, frame-ancestors, and upgrade-insecure-requests. No additional work needed.

Design Choice 2: HTML Sanitization Library

Options Considered:

1. Add sanitize-html library for rich-text fields
2. Skip library addition since no HTML-rendered fields exist

Chosen Option: 2

Rationale: Exploration confirms all sanitized fields (notes, searchTerm, description) are plain text rendered via React JSX, which auto-escapes output. No HTML rendering occurs.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Strengthen Zod Input Schemas

Ensure all router input schemas encode pagination, enum, UUID, and array constraints directly, eliminating the need for runtime validation helpers.

Task 1: Update Pagination Constraints in Game Schemas

Add proper integer, min, and max constraints to pagination fields in game-related schemas.

• Update GetGamesSchema in src/schemas/game.ts: change page to z.number().int().min(1).default(1) and limit to z.number().int().min(1).max(100).default(100)
• Update GetPendingGamesSchema in the same file with consistent pagination constraints
• BulkApproveGamesSchema and BulkRejectGamesSchema already have z.array().min(1) — no changes needed

Task 2: Update Pagination Constraints in Listing Schemas

Align listing schemas with the established pagination pattern.

• Update GetListingsSchema in src/schemas/listing.ts: add .int().min(1) to page, add .int().min(1).max(100) to limit
• Update GetPcListingsSchema in src/schemas/pcListing.ts: add .int().min(1) to page, add .int().min(1).max(50) to limit (50 matches the router's current cap)

Task 3: Standardize Listing Report Schema Constraints

Add integer constraint for consistency with other schemas.

• Update GetListingReportsSchema in src/schemas/listingReport.ts: add .int() to existing page and limit fields for consistency
• Verify reason and status fields already use z.nativeEnum() (they do — no changes needed)

🤖 Prompt for AI agents

Update Zod input schemas across three schema files to encode pagination, enum,
UUID, and array constraints declaratively, removing the need for any runtime
validation helpers.

**`src/schemas/game.ts`**
- In `GetGamesSchema`: update `page` to `z.number().int().min(1).default(1)` and
`limit` to `z.number().int().min(1).max(100).default(100)`
- Apply the same pagination constraints to `GetPendingGamesSchema`
- Leave `BulkApproveGamesSchema` and `BulkRejectGamesSchema` unchanged (already
have `z.array().min(1)`)

**`src/schemas/listing.ts`**
- In `GetListingsSchema`: add `.int().min(1)` to `page` and
`.int().min(1).max(100)` to `limit`

**`src/schemas/pcListing.ts`**
- In `GetPcListingsSchema`: add `.int().min(1)` to `page` and
`.int().min(1).max(50)` to `limit`

**`src/schemas/listingReport.ts`**
- In `GetListingReportsSchema`: add `.int()` to existing `page` and `limit`
fields
- Leave `reason` and `status` fields unchanged (already use `z.nativeEnum()`)

Phase 2: Remove Runtime Validation Calls

Remove all imports and calls to security-validation.ts functions from routers, repositories, and services.

Task 1: Clean Up Router Files

Remove redundant validation helper calls from all four router files.

• In src/server/api/routers/games.ts: remove import, remove validatePagination call in get query, remove sanitizeInput call for search, remove validateNonEmptyArray calls in bulk procedures
• In src/server/api/routers/listingReports.ts: remove import, remove validatePagination and sanitizeInput calls in get query, remove validateEnum calls in create and updateStatus mutations
• In src/server/api/routers/pcListings.ts: remove import, remove validatePagination call in get query
• In src/server/api/routers/listings/core.ts: remove import, remove validatePagination and sanitizeInput calls in get query

Task 2: Clean Up Repository Files

Remove validation helper calls from repositories.

• In src/server/repositories/user-pc-presets.repository.ts: remove import, remove validateRequired calls for userId and name, remove validateStringFormat call for UUID validation — these are enforced by upstream Zod schemas (CreatePcPresetSchema already validates all fields)
• In src/server/repositories/pc-listings.repository.ts: remove import, remove sanitizeInput call on notes field in create() method

Task 3: Clean Up Service Files

Remove sanitization from the report submission service.

• In src/server/services/report-submission.service.ts: remove import, remove sanitizeOptionalDescription helper function, pass description directly without sanitization in both createListingReport and createPcListingReport

🤖 Prompt for AI agents

Remove all imports and call sites referencing `security-validation.ts` helpers
across four routers, two repositories, and one service. Pass values directly
without intermediate validation calls — Zod schemas at the tRPC boundary now
handle all constraints.

**`src/server/api/routers/games.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` call in the `get` query
- Remove `sanitizeInput` call for the search field
- Remove `validateNonEmptyArray` calls in bulk procedures

**`src/server/api/routers/listingReports.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` and `sanitizeInput` calls in the `get` query
- Remove `validateEnum` calls in `create` and `updateStatus` mutations

**`src/server/api/routers/pcListings.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` call in the `get` query

**`src/server/api/routers/listings/core.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` and `sanitizeInput` calls in the `get` query

**`src/server/repositories/user-pc-presets.repository.ts`**
- Remove the `security-validation` import
- Remove `validateRequired` calls for `userId` and `name`
- Remove `validateStringFormat` call for UUID validation

**`src/server/repositories/pc-listings.repository.ts`**
- Remove the `security-validation` import
- Remove `sanitizeInput` call on `notes` in the `create()` method

**`src/server/services/report-submission.service.ts`**
- Remove the `security-validation` import
- Remove the `sanitizeOptionalDescription` helper function
- Pass `description` directly in both `createListingReport` and
`createPcListingReport`

Phase 3: Delete Security Validation Utility

Remove the now-unused utility file.

Delete security-validation.ts

Remove the utility file after confirming no remaining imports.

• Delete src/server/utils/security-validation.ts
• Run a project-wide search for security-validation to verify no remaining references

🤖 Prompt for AI agents

Delete the now-unused utility file and confirm no remaining references exist.

- Delete `src/server/utils/security-validation.ts`
- Run a project-wide search for `security-validation` to verify no remaining
imports or references anywhere in the codebase

Research

This is a Next.js + tRPC application using Zod for input validation at API boundaries. The security-validation.ts file contains six helper functions that duplicate what Zod already provides or apply insufficient security controls. Seven files import from this utility: four routers (games.ts, listingReports.ts, pcListings.ts, listings/core.ts), two repositories (user-pc-presets.repository.ts, pc-listings.repository.ts), and one service (report-submission.service.ts). Zod schemas reside in src/schemas/ with varying levels of pagination constraint completeness.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Update Zod input schemas across three schema files to encode pagination, enum,
UUID, and array constraints declaratively, removing the need for any runtime
validation helpers.

**`src/schemas/game.ts`**
- In `GetGamesSchema`: update `page` to `z.number().int().min(1).default(1)` and
`limit` to `z.number().int().min(1).max(100).default(100)`
- Apply the same pagination constraints to `GetPendingGamesSchema`
- Leave `BulkApproveGamesSchema` and `BulkRejectGamesSchema` unchanged (already
have `z.array().min(1)`)

**`src/schemas/listing.ts`**
- In `GetListingsSchema`: add `.int().min(1)` to `page` and
`.int().min(1).max(100)` to `limit`

**`src/schemas/pcListing.ts`**
- In `GetPcListingsSchema`: add `.int().min(1)` to `page` and
`.int().min(1).max(50)` to `limit`

**`src/schemas/listingReport.ts`**
- In `GetListingReportsSchema`: add `.int()` to existing `page` and `limit`
fields
- Leave `reason` and `status` fields unchanged (already use `z.nativeEnum()`)
===============================================================================

Task: 2

Remove all imports and call sites referencing `security-validation.ts` helpers
across four routers, two repositories, and one service. Pass values directly
without intermediate validation calls — Zod schemas at the tRPC boundary now
handle all constraints.

**`src/server/api/routers/games.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` call in the `get` query
- Remove `sanitizeInput` call for the search field
- Remove `validateNonEmptyArray` calls in bulk procedures

**`src/server/api/routers/listingReports.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` and `sanitizeInput` calls in the `get` query
- Remove `validateEnum` calls in `create` and `updateStatus` mutations

**`src/server/api/routers/pcListings.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` call in the `get` query

**`src/server/api/routers/listings/core.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` and `sanitizeInput` calls in the `get` query

**`src/server/repositories/user-pc-presets.repository.ts`**
- Remove the `security-validation` import
- Remove `validateRequired` calls for `userId` and `name`
- Remove `validateStringFormat` call for UUID validation

**`src/server/repositories/pc-listings.repository.ts`**
- Remove the `security-validation` import
- Remove `sanitizeInput` call on `notes` in the `create()` method

**`src/server/services/report-submission.service.ts`**
- Remove the `security-validation` import
- Remove the `sanitizeOptionalDescription` helper function
- Pass `description` directly in both `createListingReport` and
`createPcListingReport`
===============================================================================

Task: 3

Delete the now-unused utility file and confirm no remaining references exist.

- Delete `src/server/utils/security-validation.ts`
- Run a project-wide search for `security-validation` to verify no remaining
imports or references anywhere in the codebase

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!

[Producdevity]

Coding Plan

Summary

• Consolidate all input validation into Zod schemas at the tRPC boundary, following the pattern already established in GetPcListingReportsSchema and GetListingReportsSchema
• Remove sanitizeInput calls entirely since React's JSX escaping and Prisma's parameterized queries provide sufficient protection for plain-text fields
• Trust TypeScript's type system and Zod schemas to enforce required fields, eliminating redundant runtime guards in repositories
• Delete the utility file once all call sites are migrated

Design Choices

Design Choice 1: CSP Header Implementation

Options Considered:

1. Add CSP header as specified in ticket
2. Skip CSP work since it already exists

Chosen Option: 2

Rationale: The existing CSP covers all recommended directives including script-src, style-src, connect-src, frame-ancestors, and upgrade-insecure-requests. No additional work needed.

Design Choice 2: HTML Sanitization Library

Options Considered:

1. Add sanitize-html library for rich-text fields
2. Skip library addition since no HTML-rendered fields exist

Chosen Option: 2

Rationale: Exploration confirms all sanitized fields (notes, searchTerm, description) are plain text rendered via React JSX, which auto-escapes output. No HTML rendering occurs.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Strengthen Zod Input Schemas

Ensure all router input schemas encode pagination, enum, UUID, and array constraints directly, eliminating the need for runtime validation helpers.

Task 1: Update Pagination Constraints in Game Schemas

Add proper integer, min, and max constraints to pagination fields in game-related schemas.

• Update GetGamesSchema in src/schemas/game.ts: change page to z.number().int().min(1).default(1) and limit to z.number().int().min(1).max(100).default(100)
• Update GetPendingGamesSchema in the same file with consistent pagination constraints
• BulkApproveGamesSchema and BulkRejectGamesSchema already have z.array().min(1) — no changes needed

Task 2: Update Pagination Constraints in Listing Schemas

Align listing schemas with the established pagination pattern.

• Update GetListingsSchema in src/schemas/listing.ts: add .int().min(1) to page, add .int().min(1).max(100) to limit
• Update GetPcListingsSchema in src/schemas/pcListing.ts: add .int().min(1) to page, add .int().min(1).max(50) to limit (50 matches the router's current cap)

Task 3: Standardize Listing Report Schema Constraints

Add integer constraint for consistency with other schemas.

• Update GetListingReportsSchema in src/schemas/listingReport.ts: add .int() to existing page and limit fields for consistency
• Verify reason and status fields already use z.nativeEnum() (they do — no changes needed)

🤖 Prompt for AI agents

Update Zod input schemas across three schema files to encode pagination, enum,
UUID, and array constraints declaratively, removing the need for any runtime
validation helpers.

**`src/schemas/game.ts`**
- In `GetGamesSchema`: update `page` to `z.number().int().min(1).default(1)` and
`limit` to `z.number().int().min(1).max(100).default(100)`
- Apply the same pagination constraints to `GetPendingGamesSchema`
- Leave `BulkApproveGamesSchema` and `BulkRejectGamesSchema` unchanged (already
have `z.array().min(1)`)

**`src/schemas/listing.ts`**
- In `GetListingsSchema`: add `.int().min(1)` to `page` and
`.int().min(1).max(100)` to `limit`

**`src/schemas/pcListing.ts`**
- In `GetPcListingsSchema`: add `.int().min(1)` to `page` and
`.int().min(1).max(50)` to `limit`

**`src/schemas/listingReport.ts`**
- In `GetListingReportsSchema`: add `.int()` to existing `page` and `limit`
fields
- Leave `reason` and `status` fields unchanged (already use `z.nativeEnum()`)

Phase 2: Remove Runtime Validation Calls

Remove all imports and calls to security-validation.ts functions from routers, repositories, and services.

Task 1: Clean Up Router Files

Remove redundant validation helper calls from all four router files.

• In src/server/api/routers/games.ts: remove import, remove validatePagination call in get query, remove sanitizeInput call for search, remove validateNonEmptyArray calls in bulk procedures
• In src/server/api/routers/listingReports.ts: remove import, remove validatePagination and sanitizeInput calls in get query, remove validateEnum calls in create and updateStatus mutations
• In src/server/api/routers/pcListings.ts: remove import, remove validatePagination call in get query
• In src/server/api/routers/listings/core.ts: remove import, remove validatePagination and sanitizeInput calls in get query

Task 2: Clean Up Repository Files

Remove validation helper calls from repositories.

• In src/server/repositories/user-pc-presets.repository.ts: remove import, remove validateRequired calls for userId and name, remove validateStringFormat call for UUID validation — these are enforced by upstream Zod schemas (CreatePcPresetSchema already validates all fields)
• In src/server/repositories/pc-listings.repository.ts: remove import, remove sanitizeInput call on notes field in create() method

Task 3: Clean Up Service Files

Remove sanitization from the report submission service.

• In src/server/services/report-submission.service.ts: remove import, remove sanitizeOptionalDescription helper function, pass description directly without sanitization in both createListingReport and createPcListingReport

🤖 Prompt for AI agents

Remove all imports and call sites referencing `security-validation.ts` helpers
across four routers, two repositories, and one service. Pass values directly
without intermediate validation calls — Zod schemas at the tRPC boundary now
handle all constraints.

**`src/server/api/routers/games.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` call in the `get` query
- Remove `sanitizeInput` call for the search field
- Remove `validateNonEmptyArray` calls in bulk procedures

**`src/server/api/routers/listingReports.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` and `sanitizeInput` calls in the `get` query
- Remove `validateEnum` calls in `create` and `updateStatus` mutations

**`src/server/api/routers/pcListings.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` call in the `get` query

**`src/server/api/routers/listings/core.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` and `sanitizeInput` calls in the `get` query

**`src/server/repositories/user-pc-presets.repository.ts`**
- Remove the `security-validation` import
- Remove `validateRequired` calls for `userId` and `name`
- Remove `validateStringFormat` call for UUID validation

**`src/server/repositories/pc-listings.repository.ts`**
- Remove the `security-validation` import
- Remove `sanitizeInput` call on `notes` in the `create()` method

**`src/server/services/report-submission.service.ts`**
- Remove the `security-validation` import
- Remove the `sanitizeOptionalDescription` helper function
- Pass `description` directly in both `createListingReport` and
`createPcListingReport`

Phase 3: Delete Security Validation Utility

Remove the now-unused utility file.

Delete security-validation.ts

Remove the utility file after confirming no remaining imports.

• Delete src/server/utils/security-validation.ts
• Run a project-wide search for security-validation to verify no remaining references

🤖 Prompt for AI agents

Delete the now-unused utility file and confirm no remaining references exist.

- Delete `src/server/utils/security-validation.ts`
- Run a project-wide search for `security-validation` to verify no remaining
imports or references anywhere in the codebase

Research

This is a Next.js + tRPC application using Zod for input validation at API boundaries. The security-validation.ts file contains six helper functions that duplicate what Zod already provides or apply insufficient security controls. Seven files import from this utility: four routers (games.ts, listingReports.ts, pcListings.ts, listings/core.ts), two repositories (user-pc-presets.repository.ts, pc-listings.repository.ts), and one service (report-submission.service.ts). Zod schemas reside in src/schemas/ with varying levels of pagination constraint completeness.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Update Zod input schemas across three schema files to encode pagination, enum,
UUID, and array constraints declaratively, removing the need for any runtime
validation helpers.

**`src/schemas/game.ts`**
- In `GetGamesSchema`: update `page` to `z.number().int().min(1).default(1)` and
`limit` to `z.number().int().min(1).max(100).default(100)`
- Apply the same pagination constraints to `GetPendingGamesSchema`
- Leave `BulkApproveGamesSchema` and `BulkRejectGamesSchema` unchanged (already
have `z.array().min(1)`)

**`src/schemas/listing.ts`**
- In `GetListingsSchema`: add `.int().min(1)` to `page` and
`.int().min(1).max(100)` to `limit`

**`src/schemas/pcListing.ts`**
- In `GetPcListingsSchema`: add `.int().min(1)` to `page` and
`.int().min(1).max(50)` to `limit`

**`src/schemas/listingReport.ts`**
- In `GetListingReportsSchema`: add `.int()` to existing `page` and `limit`
fields
- Leave `reason` and `status` fields unchanged (already use `z.nativeEnum()`)
===============================================================================

Task: 2

Remove all imports and call sites referencing `security-validation.ts` helpers
across four routers, two repositories, and one service. Pass values directly
without intermediate validation calls — Zod schemas at the tRPC boundary now
handle all constraints.

**`src/server/api/routers/games.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` call in the `get` query
- Remove `sanitizeInput` call for the search field
- Remove `validateNonEmptyArray` calls in bulk procedures

**`src/server/api/routers/listingReports.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` and `sanitizeInput` calls in the `get` query
- Remove `validateEnum` calls in `create` and `updateStatus` mutations

**`src/server/api/routers/pcListings.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` call in the `get` query

**`src/server/api/routers/listings/core.ts`**
- Remove the `security-validation` import
- Remove `validatePagination` and `sanitizeInput` calls in the `get` query

**`src/server/repositories/user-pc-presets.repository.ts`**
- Remove the `security-validation` import
- Remove `validateRequired` calls for `userId` and `name`
- Remove `validateStringFormat` call for UUID validation

**`src/server/repositories/pc-listings.repository.ts`**
- Remove the `security-validation` import
- Remove `sanitizeInput` call on `notes` in the `create()` method

**`src/server/services/report-submission.service.ts`**
- Remove the `security-validation` import
- Remove the `sanitizeOptionalDescription` helper function
- Pass `description` directly in both `createListingReport` and
`createPcListingReport`
===============================================================================

Task: 3

Delete the now-unused utility file and confirm no remaining references exist.

- Delete `src/server/utils/security-validation.ts`
- Run a project-wide search for `security-validation` to verify no remaining
imports or references anywhere in the codebase

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!

@coderabbitai Make a new PR to staging branch implementing this plan.