diff --git a/backend/handlers/auth/local.go b/backend/handlers/auth/local.go
index 736f1df..1fe831f 100644
--- a/backend/handlers/auth/local.go
+++ b/backend/handlers/auth/local.go
@@ -407,11 +407,11 @@ func RefreshTokenHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 type VerificationCodeRequest struct {
-	Email string `json:"email"`
+	Email string `json:"email" validate:"required,email,max=254"`
 }
 
 type VerifyCodeRequest struct {
-	Code string `json:"code"`
+	Code string `json:"code" validate:"required,max=64"`
 }
 
 type VerificationResponse struct {
@@ -425,6 +425,10 @@ func GenerateVerificationCodeHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "invalid request", http.StatusBadRequest)
 		return
 	}
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 
 	email := strings.TrimSpace(strings.ToLower(req.Email))
 	if email == "" {
@@ -472,6 +476,10 @@ func VerifyCodeHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "invalid request", http.StatusBadRequest)
 		return
 	}
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 
 	code := strings.TrimSpace(req.Code)
 	if code == "" {
diff --git a/backend/handlers/services/services.go b/backend/handlers/services/services.go
index ae10752..2c5b1f9 100644
--- a/backend/handlers/services/services.go
+++ b/backend/handlers/services/services.go
@@ -88,6 +88,10 @@ func CreateServiceHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest)
 		return
 	}
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 
 	// Basic validation
 	if req.Name == "" {
diff --git a/backend/handlers/user/profile.go b/backend/handlers/user/profile.go
index 1c3fb52..7937f8b 100644
--- a/backend/handlers/user/profile.go
+++ b/backend/handlers/user/profile.go
@@ -657,7 +657,7 @@ func GetEligiblePatchTestServicesHandler(w http.ResponseWriter, r *http.Request)
 }
 
 type AddPatchTestRequest struct {
-	PatchTestID string `json:"patch_test_id"`
+	PatchTestID string `json:"patch_test_id" validate:"required"`
 }
 
 // POST /api/admin/users/{id}/patch-tests
@@ -674,6 +674,10 @@ func AddPatchTestHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "invalid request", http.StatusBadRequest)
 		return
 	}
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 
 	if req.PatchTestID == "" {
 		http.Error(w, "patch_test_id is required", http.StatusBadRequest)