---
description: Define an API contract before writing the handler.
globs: "**/*.{ts,tsx}"
alwaysApply: false
---

# Contract-first APIs

- Name the method, the path, the request fields, and the response fields before you write the handler.
- Validate input on the server even if the form already checked it.
- Return one error shape. Do not leak stack traces, keys, or database details to the browser.
- Do not log passwords, tokens, or other secrets.
- If the payload is sensitive, encrypt it before it leaves the client and keep the keys off the public bundle.