diff --git a/netlify.toml b/netlify.toml
index 752615e..51ec115 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -10,3 +10,12 @@ NODE_VERSION = "26"
 from = "/*"
 to = "/index.html"
 status = 200
+
+[[headers]]
+for = "/"
+[headers.values]
+X-Content-Type-Options = "nosniff"
+X-Frame-Options = "DENY"
+Referrer-Policy = "strict-origin-when-cross-origin"
+# 'wasm-unsafe-eval' required by ghostty-web's WASM (oof)
+Content-Security-Policy = "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; img-src 'self' data:; font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'wasm-unsafe-eval' 'sha256-xwh0ztIl9GHVCIxpY9WA9wA4ops+/NNgJ9C0UKIv/L4='; connect-src 'self'"
diff --git a/netlify/functions/reports.ts b/netlify/functions/reports.ts
index ca27319..5a63bee 100644
--- a/netlify/functions/reports.ts
+++ b/netlify/functions/reports.ts
@@ -15,6 +15,7 @@ import {
   saveReportSnapshot,
 } from "./_shared/report-persistence.js";
 import { scheduleDailyTrustReport } from "./_shared/report-schedules.js";
+import { ReportPostBodySchema, parseOrNull } from "../../src/lib/schemas.js";
 
 const RECENT_REPORT_LIMIT = 5;
 
@@ -104,20 +105,15 @@ export default async (req: Request) => {
 
     if (id) return new Response("Not found", { status: 404 });
 
-    let body: {
-      orgs?: string[];
-      scope?: unknown;
-      scopeLabel?: string;
-      capturedAt?: string;
-      payload?: unknown;
-    };
+    let raw: unknown;
     try {
-      body = await req.json();
+      raw = await req.json();
     } catch {
       return new Response("Invalid JSON", { status: 400 });
     }
-    if (!body || typeof body !== "object" || body.payload == null) {
-      return new Response("Missing payload", { status: 400 });
+    const body = parseOrNull(ReportPostBodySchema, raw);
+    if (!body) {
+      return new Response("Missing or invalid report body", { status: 400 });
     }
     const orgs = Array.isArray(body.orgs) ? body.orgs.map(String) : [];
     const scope = parseScope(body.scope, body.scopeLabel);
diff --git a/package.json b/package.json
index 4127dea..1f77b11 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,8 @@
     "drizzle-orm": "1.0.0-rc.4-5d5b77c",
     "ghostty-web": "^0.4.0",
     "packumeta": "0.4.1",
-    "svelte": "^5.56.4"
+    "svelte": "^5.56.4",
+    "valibot": "^1.4.2"
   },
   "devDependencies": {
     "@axe-core/playwright": "^4.12.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e1a1061..0f5fa2a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -224,7 +224,7 @@ importers:
         version: 7.1.2(svelte@5.56.4(@typescript-eslint/types@8.62.0))(vite@8.1.0(@types/node@26.0.1)(esbuild@0.28.0)(jiti@2.7.0)(yaml@2.9.0))
       drizzle-orm:
         specifier: 1.0.0-rc.4-5d5b77c
-        version: 1.0.0-rc.4-5d5b77c(@neondatabase/serverless@1.1.0)(@opentelemetry/api@1.9.0)(pg@8.22.0)(zod@4.4.3)
+        version: 1.0.0-rc.4-5d5b77c(@neondatabase/serverless@1.1.0)(@opentelemetry/api@1.9.0)(pg@8.22.0)(valibot@1.4.2(typescript@6.0.3))(zod@4.4.3)
       ghostty-web:
         specifier: ^0.4.0
         version: 0.4.0
@@ -234,6 +234,9 @@ importers:
       svelte:
         specifier: ^5.56.4
         version: 5.56.4(@typescript-eslint/types@8.62.0)
+      valibot:
+        specifier: ^1.4.2
+        version: 1.4.2(typescript@6.0.3)
     devDependencies:
       '@axe-core/playwright':
         specifier: ^4.12.1
@@ -4579,6 +4582,14 @@ packages:
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
 
+  valibot@1.4.2:
+    resolution: {integrity: sha512-gjdCvJ6d3RyHAneqxMYMW9QMCwYMb3jpOO0IyHZV1bnRHFBHrX3VkIILt5XYR0WhwHiH7Mty8ovuPZ/O3gamrg==}
+    peerDependencies:
+      typescript: '>=5'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
   validate-npm-package-license@3.0.4:
     resolution: {integrity: sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==}
 
@@ -6990,11 +7001,12 @@ snapshots:
       get-tsconfig: 4.14.0
       jiti: 2.7.0
 
-  drizzle-orm@1.0.0-rc.4-5d5b77c(@neondatabase/serverless@1.1.0)(@opentelemetry/api@1.9.0)(pg@8.22.0)(zod@4.4.3):
+  drizzle-orm@1.0.0-rc.4-5d5b77c(@neondatabase/serverless@1.1.0)(@opentelemetry/api@1.9.0)(pg@8.22.0)(valibot@1.4.2(typescript@6.0.3))(zod@4.4.3):
     optionalDependencies:
       '@neondatabase/serverless': 1.1.0
       '@opentelemetry/api': 1.9.0
       pg: 8.22.0
+      valibot: 1.4.2(typescript@6.0.3)
       zod: 4.4.3
 
   dunder-proto@1.0.1:
@@ -9027,6 +9039,10 @@ snapshots:
 
   util-deprecate@1.0.2: {}
 
+  valibot@1.4.2(typescript@6.0.3):
+    optionalDependencies:
+      typescript: 6.0.3
+
   validate-npm-package-license@3.0.4:
     dependencies:
       spdx-correct: 3.2.0
diff --git a/src/App.svelte b/src/App.svelte
index 5a7aa88..4d7c300 100644
--- a/src/App.svelte
+++ b/src/App.svelte
@@ -15,6 +15,7 @@
   import { scopeLabelFor } from "./lib/reportHistory";
   import { runUserPublishes } from "./lib/reports";
   import { runAudit, type AuditResult } from "./lib/runAudit";
+  import { parseOrNull, SaveResponseSchema } from "./lib/schemas";
   import type { AuditConfig, ReportKind, UserPublishReport } from "./lib/types";
 
   type TerminalHandle = {
@@ -142,7 +143,10 @@
         }),
       });
       if (!response.ok) throw new Error(`Save failed (${response.status})`);
-      const { id } = (await response.json()) as { id: string };
+      const data = await response.json();
+      if (!parseOrNull(SaveResponseSchema, data))
+        throw new Error("Save failed (unexpected response)");
+      const { id } = data as { id: string };
       if (attempt !== saveAttempt) return;
       savedReportId = id;
       savedReportCanTrackDaily = context.scope === "all" && !!nextResult.recent;
@@ -166,7 +170,7 @@
       error = "Select at least one report.";
       return;
     }
-    if (selected.external && members.length === 0 && selectedKinds.length === 1) {
+    if (selected.external && members.length === 0) {
       error =
         "The external report needs your npm org member list. npm does not expose org membership publicly.";
       return;
diff --git a/src/SharedReport.svelte b/src/SharedReport.svelte
index 1ebaa39..40dc95d 100644
--- a/src/SharedReport.svelte
+++ b/src/SharedReport.svelte
@@ -4,6 +4,7 @@
   import ResultsView from "./components/ResultsView.svelte";
   import ThemeToggle from "./components/ThemeToggle.svelte";
   import type { AuditResult } from "./lib/runAudit";
+  import { parseOrNull, ReportRecordSchema } from "./lib/schemas";
 
   interface ReportRecord {
     id: string;
@@ -54,7 +55,11 @@
       .then(async (response) => {
         if (response.status === 404) throw new Error("This report could not be found.");
         if (!response.ok) throw new Error(`Failed to load report (${response.status}).`);
-        return (await response.json()) as ReportRecord;
+        const data: unknown = await response.json();
+        if (!parseOrNull(ReportRecordSchema, data)) {
+          throw new Error("This report is in an unexpected format and can't be displayed.");
+        }
+        return data as ReportRecord;
       })
       .then((next) => {
         if (!cancelled) record = next;
diff --git a/src/components/DailyTrackingButton.svelte b/src/components/DailyTrackingButton.svelte
index d5862a6..025b759 100644
--- a/src/components/DailyTrackingButton.svelte
+++ b/src/components/DailyTrackingButton.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import { CalendarClock } from "@lucide/svelte";
   import type { ReportRerunScheduleStatus } from "../lib/reportHistory";
+  import { parseOrNull, ReportRerunScheduleStatusSchema } from "../lib/schemas";
 
   interface Props {
     reportId: string | null;
@@ -22,7 +23,11 @@
         method: "POST",
       });
       if (!response.ok) throw new Error(`Tracking failed (${response.status})`);
-      const body = (await response.json()) as ReportRerunScheduleStatus;
+      const data = await response.json();
+      if (!parseOrNull(ReportRerunScheduleStatusSchema, data)) {
+        throw new Error("Tracking failed (unexpected response)");
+      }
+      const body = data as ReportRerunScheduleStatus;
       status = "done";
       message = `Next run ${new Date(body.nextRunAt).toISOString().slice(0, 10)}.`;
       onToast("Daily tracking enabled");
diff --git a/src/components/HistoryPanel.svelte b/src/components/HistoryPanel.svelte
index 1f6ccd3..bc3375c 100644
--- a/src/components/HistoryPanel.svelte
+++ b/src/components/HistoryPanel.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import Stat from "./Stat.svelte";
   import type { ReportHistoryResponse, ReportTrustHistoryPoint } from "../lib/reportHistory";
+  import { parseOrNull, ReportHistoryResponseSchema } from "../lib/schemas";
   import type { TrustLevel } from "../lib/types";
 
   interface Props {
@@ -82,7 +83,10 @@
     fetch(`/api/reports/history?${params}`)
       .then(async (next) => {
         if (!next.ok) return { orgs: cleanOrgs, points: [] };
-        return (await next.json()) as Partial<ReportHistoryResponse>;
+        const data = await next.json();
+        return parseOrNull(ReportHistoryResponseSchema, data)
+          ? (data as ReportHistoryResponse)
+          : { orgs: cleanOrgs, points: [] };
       })
       .then((body) => {
         if (cancelled || token !== refreshKey) return;
diff --git a/src/components/RecentReports.svelte b/src/components/RecentReports.svelte
index a557a95..b31bee1 100644
--- a/src/components/RecentReports.svelte
+++ b/src/components/RecentReports.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
   import type { RecentTrustReportLink, RecentTrustReportsResponse } from "../lib/reportHistory";
+  import { parseOrNull, RecentTrustReportsResponseSchema } from "../lib/schemas";
 
   let reports = $state<RecentTrustReportLink[]>([]);
   let loading = $state(true);
@@ -19,7 +20,10 @@
     fetch("/api/reports/recent")
       .then(async (response) => {
         if (!response.ok) return { reports: [] };
-        return (await response.json()) as Partial<RecentTrustReportsResponse>;
+        const data = await response.json();
+        return parseOrNull(RecentTrustReportsResponseSchema, data)
+          ? (data as RecentTrustReportsResponse)
+          : { reports: [] };
       })
       .then((body) => {
         if (!cancelled) reports = Array.isArray(body.reports) ? body.reports : [];
diff --git a/src/lib/npmClient.test.ts b/src/lib/npmClient.test.ts
index 0f529c1..570a4c6 100644
--- a/src/lib/npmClient.test.ts
+++ b/src/lib/npmClient.test.ts
@@ -84,7 +84,7 @@ describe("npm client", () => {
     expect(failures.count).toBe(0);
   });
 
-  it("treats 404 as legitimately empty and JSON parse errors as empty", async () => {
+  it("treats 404 as legitimately empty but logs a non-empty unparseable body as a failure", async () => {
     const fetchMock = vi
       .fn()
       .mockResolvedValueOnce(textResponse("missing", 404))
@@ -92,9 +92,15 @@ describe("npm client", () => {
     vi.stubGlobal("fetch", fetchMock);
     const failures = new FailureLog();
 
+    // 404 is a legitimately-empty result: null, nothing recorded.
     await expect(npmGet("https://registry.npmjs.org/nope", failures)).resolves.toBeNull();
-    await expect(npmGetJson("https://registry.npmjs.org/nope", failures)).resolves.toBeNull();
     expect(failures.count).toBe(0);
+
+    // A 200 whose body isn't JSON (e.g. an HTML rate-limit interstitial) is NOT
+    // empty — it must be recorded so the UI can warn results are incomplete.
+    const url = "https://registry.npmjs.org/bad";
+    await expect(npmGetJson(url, failures)).resolves.toBeNull();
+    expect(failures.failures).toEqual([{ url, reason: "unparseable JSON response" }]);
   });
 
   it("formats registry URLs and ISO epochs", () => {
diff --git a/src/lib/npmClient.ts b/src/lib/npmClient.ts
index 21162ce..d1f7747 100644
--- a/src/lib/npmClient.ts
+++ b/src/lib/npmClient.ts
@@ -141,7 +141,13 @@ export async function npmGet(
   }
 }
 
-/** Convenience: npm_get + JSON.parse, returning null on empty/parse error. */
+/**
+ * Convenience: npm_get + JSON.parse. An empty body (null / "") is a
+ * legitimately-empty result and returns null silently. But a NON-empty body
+ * that fails to parse (e.g. a 200 HTML rate-limit interstitial) is NOT empty —
+ * treating it as such would silently zero out an audit, so it's recorded in the
+ * FailureLog per the "no silent failure" invariant, matching discovery.ts.
+ */
 export async function npmGetJson<T = unknown>(
   url: string,
   failures: FailureLog,
@@ -153,6 +159,7 @@ export async function npmGetJson<T = unknown>(
   try {
     return JSON.parse(body) as T;
   } catch {
+    failures.add(url, "unparseable JSON response");
     return null;
   }
 }
diff --git a/src/lib/schemas.ts b/src/lib/schemas.ts
new file mode 100644
index 0000000..9fab00f
--- /dev/null
+++ b/src/lib/schemas.ts
@@ -0,0 +1,145 @@
+// Valibot schemas for every JSON that crosses a trust boundary: the request
+// body of POST /api/reports (server) and every API response the client
+// deserializes. Parsing here replaces bare `as T` casts so a malformed payload
+// degrades gracefully (e.g. a bad shared-report payload shows an error instead
+// of throwing inside a view) rather than being trusted blindly.
+//
+// Objects use `looseObject` so unknown/extra keys pass through — we validate the
+// fields the app actually reads, not the exact shape.
+import * as v from "valibot";
+
+const TrustLevel = v.picklist(["stagedPublish", "trustedPublisher", "provenance", "none"]);
+
+const ByLevel = v.object({
+  stagedPublish: v.number(),
+  trustedPublisher: v.number(),
+  provenance: v.number(),
+  none: v.number(),
+});
+
+const RecentRow = v.looseObject({
+  pkg: v.string(),
+  latestPublish: v.string(),
+  version: v.string(),
+  level: TrustLevel,
+  provenance: v.boolean(),
+  trustedPublisher: v.boolean(),
+  stagedPublish: v.boolean(),
+  publisher: v.string(),
+  deprecated: v.boolean(),
+  downloads: v.nullable(v.number()),
+});
+
+const RecentReport = v.looseObject({
+  rows: v.array(RecentRow),
+  summary: v.looseObject({
+    scopeLabel: v.string(),
+    orgs: v.array(v.string()),
+    total: v.number(),
+    provenance: v.number(),
+    trustedPublisher: v.number(),
+    stagedPublish: v.number(),
+    deprecated: v.number(),
+    byLevel: ByLevel,
+  }),
+});
+
+const ManualReport = v.looseObject({
+  rows: v.array(v.looseObject({ when: v.string(), who: v.string(), ref: v.string() })),
+  totalScanned: v.number(),
+  bots: v.array(v.string()),
+  byPublisher: v.array(v.looseObject({ who: v.string(), count: v.number() })),
+});
+
+const ExternalReport = v.looseObject({
+  rows: v.array(v.looseObject({ user: v.string(), pkg: v.string() })),
+  distinctUsers: v.number(),
+  byUser: v.array(v.looseObject({ user: v.string(), count: v.number() })),
+});
+
+const FetchFailure = v.looseObject({ url: v.string(), reason: v.string() });
+
+/** A completed audit result. recent/manual/external are present only for the
+ *  reports that were run; failures is always an array. */
+export const AuditResultSchema = v.looseObject({
+  recent: v.optional(RecentReport),
+  manual: v.optional(ManualReport),
+  external: v.optional(ExternalReport),
+  failures: v.array(FetchFailure),
+});
+
+/** The row returned by GET /api/reports/:id and rendered read-only at /report/:id. */
+export const ReportRecordSchema = v.looseObject({
+  id: v.string(),
+  orgs: v.string(),
+  scopeLabel: v.string(),
+  payload: AuditResultSchema,
+  createdAt: v.nullable(v.string()),
+});
+
+/** Response of POST /api/reports. */
+export const SaveResponseSchema = v.looseObject({ id: v.string() });
+
+const TrustHistoryPoint = v.looseObject({
+  id: v.string(),
+  url: v.string(),
+  capturedAt: v.string(),
+  total: v.number(),
+  byLevel: ByLevel,
+  deprecated: v.number(),
+  failureCount: v.number(),
+});
+
+/** GET /api/reports/history?org=... */
+export const ReportHistoryResponseSchema = v.looseObject({
+  orgs: v.array(v.string()),
+  points: v.array(TrustHistoryPoint),
+});
+
+/** GET /api/reports/recent */
+export const RecentTrustReportsResponseSchema = v.looseObject({
+  reports: v.array(
+    v.looseObject({
+      id: v.string(),
+      url: v.string(),
+      orgs: v.array(v.string()),
+      capturedAt: v.string(),
+    }),
+  ),
+});
+
+/** POST /api/reports/:id/schedule-daily */
+export const ReportRerunScheduleStatusSchema = v.looseObject({
+  orgs: v.array(v.string()),
+  enabled: v.boolean(),
+  nextRunAt: v.string(),
+  lastRunAt: v.nullable(v.string()),
+  lastReportId: v.nullable(v.string()),
+  consecutiveFailures: v.number(),
+});
+
+// --- server side ---------------------------------------------------------
+
+// Envelope for POST /api/reports. Deliberately lenient on the payload internals
+// (stored as opaque JSON; only extractTrustHistory reads specific fields) — the
+// payload just has to be a JSON object. orgs/scope/scopeLabel/capturedAt are
+// optional and coerced downstream. Strict payload rejection + a size cap belong
+// with the write-path/abuse hardening, not here.
+export const ReportPostBodySchema = v.object({
+  // Left as unknown to match the handler's existing lenient coercion (e.g.
+  // non-array orgs -> []); the only hard requirement is a present object payload.
+  orgs: v.optional(v.unknown()),
+  scope: v.optional(v.unknown()),
+  scopeLabel: v.optional(v.unknown()),
+  capturedAt: v.optional(v.unknown()),
+  payload: v.looseObject({}),
+});
+
+/** Parse `value` against `schema`, returning the typed value or null on failure. */
+export function parseOrNull<TSchema extends v.GenericSchema>(
+  schema: TSchema,
+  value: unknown,
+): v.InferOutput<TSchema> | null {
+  const result = v.safeParse(schema, value);
+  return result.success ? result.output : null;
+}