Priority: high
Description
API endpoints that accept wallet addresses and other inputs should be tested against injection payloads to verify they are handled safely.
Acceptance Criteria
- Test: SQL injection payload in wallet address returns 400 (not 500)
- Test: NoSQL injection payload in request body is rejected by validation
- Test: Oversized request body (>1MB) returns 413
- Test: Null byte in wallet address is rejected
- All injection tests result in 400 responses, not unhandled errors
Priority: high
Description
API endpoints that accept wallet addresses and other inputs should be tested against injection payloads to verify they are handled safely.
Acceptance Criteria