diff --git a/cmd/api/handlers.go b/cmd/api/handlers.go
index c2712cb..a520f42 100644
--- a/cmd/api/handlers.go
+++ b/cmd/api/handlers.go
@@ -560,6 +560,10 @@ func GetSavedCities(hc *HandlerContext, w http.ResponseWriter, r *http.Request)
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	cities, err := hc.Preferences.GetSavedCities(r.Context(), userID)
 	if err != nil {
@@ -580,6 +584,10 @@ func AddSavedCity(hc *HandlerContext, w http.ResponseWriter, r *http.Request) {
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	var req struct {
 		CityCode string `json:"city_code"`
@@ -607,6 +615,10 @@ func RemoveSavedCity(hc *HandlerContext, w http.ResponseWriter, r *http.Request)
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	parts := strings.Split(r.URL.Path, "/")
 	// Expected: /v1/preferences/saved-cities/{city_code} -> parts: ["", "v1", "preferences", "saved-cities", "{city_code}"]
@@ -633,6 +645,10 @@ func GetSearchHistory(hc *HandlerContext, w http.ResponseWriter, r *http.Request
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	history, err := hc.Preferences.GetSearchHistory(r.Context(), userID)
 	if err != nil {
@@ -653,6 +669,10 @@ func AddSearchHistory(hc *HandlerContext, w http.ResponseWriter, r *http.Request
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	var req struct {
 		FromCity string `json:"from_city"`
diff --git a/cmd/api/main.go b/cmd/api/main.go
index 39c717f..9afbea0 100644
--- a/cmd/api/main.go
+++ b/cmd/api/main.go
@@ -21,7 +21,7 @@ func main() {
 
 	apiKey := os.Getenv("YANDEX_API_KEY")
 	if apiKey == "" {
-		apiKey = "default-key" // fallback for development
+		log.Fatal("YANDEX_API_KEY environment variable is not set")
 	}
 	yandexClient := yandex.NewClient(apiKey, yandex.WithMetrics(m))