backend/app.py: Missing request input validation for incoming JSON payloads