Validation
Are all inputs validated using Zod?
Are query parameters sanitized?
Authentication & Authorization
Is the endpoint protected by an auth guard?
Does the user have permission to access the requested resource?
Error Handling
Are expected errors returning appropriate HTTP status codes (400, 401, 403, 404)?
Are unexpected server errors handled gracefully (500) without leaking sensitive info?