Start here. This is the direct spoken answer to practice first.
Why this matters
Investigate an endpoint accepting invalid data or returning inconsistent validation errors. It matters in real backend work because clients depend on stable status codes, request and response shape, validation behavior, and compatibility after the endpoint ships. The practical angle is validation layers, DTO changes, model binding, error consistency, regression tests, and data cleanup, tied to a concrete production decision.
I reproduce the smallest request that now passes incorrectly and inspect the value after model binding. Then I locate the failed boundary: request-shape validation, an application rule, a domain invariant, or a database constraint. Recent DTO, nullability, serializer, and validator changes are the first comparison points. The fix belongs where that rule can be enforced consistently, followed by a regression test for the exact payload.