diff --git a/src/app/api/bounties/route.test.ts b/src/app/api/bounties/route.test.ts
index 9fd082f3..e8593c42 100644
--- a/src/app/api/bounties/route.test.ts
+++ b/src/app/api/bounties/route.test.ts
@@ -4,8 +4,13 @@ vi.mock("@/lib/supabase/server", () => ({
   createClient: vi.fn(),
 }));
 
-import { GET } from "./route";
+vi.mock("@/lib/auth/get-user", () => ({
+  getAuthContext: vi.fn(),
+}));
+
+import { GET, POST } from "./route";
 import { createClient } from "@/lib/supabase/server";
+import { getAuthContext } from "@/lib/auth/get-user";
 
 function makeReq(url: string) {
   return { nextUrl: new URL(url) } as any;
@@ -60,3 +65,26 @@ describe("GET /api/bounties", () => {
   });
 });
 
+describe("POST /api/bounties", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("returns 400 for malformed JSON without querying Supabase", async () => {
+    const from = vi.fn();
+    (getAuthContext as any).mockResolvedValue({
+      user: { id: "user-1" },
+      supabase: { from },
+    });
+    const request = {
+      json: vi.fn().mockRejectedValue(new SyntaxError("Invalid JSON")),
+    } as any;
+
+    const response = await POST(request);
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toEqual({
+      error: "Invalid JSON body",
+    });
+    expect(from).not.toHaveBeenCalled();
+  });
+});
+
diff --git a/src/app/api/bounties/route.ts b/src/app/api/bounties/route.ts
index bed6a887..778d8740 100644
--- a/src/app/api/bounties/route.ts
+++ b/src/app/api/bounties/route.ts
@@ -109,7 +109,15 @@ export async function POST(request: NextRequest) {
     }
     const { user, supabase } = auth;
 
-    const body = await request.json();
+    let body: unknown;
+    try {
+      body = await request.json();
+    } catch {
+      return NextResponse.json(
+        { error: "Invalid JSON body" },
+        { status: 400 }
+      );
+    }
     const parsed = createBountySchema.safeParse(body);
     if (!parsed.success) {
       return NextResponse.json(