Next.js route handlers: how to avoid leaking runtime info and handle JSON parse errors cleanly?