From ec599c129e682d7190f0b9dfade8d2ed0449feac Mon Sep 17 00:00:00 2001
From: orbisai0security <mediratta@gmail.com>
Date: Sun, 19 Jul 2026 08:20:48 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 backend/server.py | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/backend/server.py b/backend/server.py
index ba64aa2..74c95a7 100644
--- a/backend/server.py
+++ b/backend/server.py
@@ -327,6 +327,10 @@ class User(BaseModel):
     created_at: datetime
 
 
+class FounderTypeRequest(BaseModel):
+    founder_type: Literal["first_time", "technical", "non_technical", "repeat"]
+
+
 class IdeaCreate(BaseModel):
     title: str
     one_liner: str
@@ -454,19 +458,16 @@ async def auth_me(
 
 @api.post("/auth/founder-type")
 async def set_founder_type(
+    payload: FounderTypeRequest,
     request: Request,
     session_token_cookie: Optional[str] = Cookie(None, alias="session_token"),
     authorization: Optional[str] = Header(None),
 ):
     user = await get_current_user(request, session_token_cookie, authorization)
-    body = await request.json()
-    ftype = body.get("founder_type")
-    if ftype not in ["first_time", "technical", "non_technical", "repeat"]:
-        raise HTTPException(status_code=400, detail="Invalid founder_type")
     await db.users.update_one(
-        {"user_id": user.user_id}, {"$set": {"founder_type": ftype}}
+        {"user_id": user.user_id}, {"$set": {"founder_type": payload.founder_type}}
     )
-    return {"ok": True, "founder_type": ftype}
+    return {"ok": True, "founder_type": payload.founder_type}
 
 
 # ---------- Ideas ----------