How Zod's .refine() Can Cause a Denial of Service — And How to Fix It

TL;DR Zod's .refine() executes on every input — even when earlier validators like .min() and .max() have already failed. If you place an expensive operation such as a database query inside .refine(), an attacker can trigger that query with every request, including requests containing completely in