diff --git a/src/api/core/events.rs b/src/api/core/events.rs
index d1612255..86de1b8e 100644
--- a/src/api/core/events.rs
+++ b/src/api/core/events.rs
@@ -41,11 +41,11 @@ async fn get_org_events(org_id: OrganizationId, data: EventRange, headers: Admin
     let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
         Vec::with_capacity(0)
     } else {
-        let start_date = parse_date(&data.start);
+        let start_date = parse_date(&data.start)?;
         let end_date = if let Some(before_date) = &data.continuation_token {
-            parse_date(before_date)
+            parse_date(before_date)?
         } else {
-            parse_date(&data.end)
+            parse_date(&data.end)?
         };
 
         Event::find_by_organization_uuid(&org_id, &start_date, &end_date, &conn)
@@ -71,11 +71,11 @@ async fn get_cipher_events(cipher_id: CipherId, data: EventRange, headers: Heade
     } else {
         let mut events_json = Vec::with_capacity(0);
         if Membership::user_has_ge_admin_access_to_cipher(&headers.user.uuid, &cipher_id, &conn).await {
-            let start_date = parse_date(&data.start);
+            let start_date = parse_date(&data.start)?;
             let end_date = if let Some(before_date) = &data.continuation_token {
-                parse_date(before_date)
+                parse_date(before_date)?
             } else {
-                parse_date(&data.end)
+                parse_date(&data.end)?
             };
 
             events_json = Event::find_by_cipher_uuid(&cipher_id, &start_date, &end_date, &conn)
@@ -110,11 +110,11 @@ async fn get_user_events(
     let events_json: Vec<Value> = if !CONFIG.org_events_enabled() {
         Vec::with_capacity(0)
     } else {
-        let start_date = parse_date(&data.start);
+        let start_date = parse_date(&data.start)?;
         let end_date = if let Some(before_date) = &data.continuation_token {
-            parse_date(before_date)
+            parse_date(before_date)?
         } else {
-            parse_date(&data.end)
+            parse_date(&data.end)?
         };
 
         Event::find_by_org_and_member(&org_id, &member_id, &start_date, &end_date, &conn)
@@ -173,7 +173,7 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
     }
 
     for event in data.iter() {
-        let event_date = parse_date(&event.date);
+        let event_date = parse_date(&event.date)?;
         match event.r#type {
             1000..=1099 => {
                 _log_user_event(
diff --git a/src/api/core/sends.rs b/src/api/core/sends.rs
index 10bf85be..6a1982dc 100644
--- a/src/api/core/sends.rs
+++ b/src/api/core/sends.rs
@@ -23,7 +23,7 @@ use crate::{
 
 const SEND_INACCESSIBLE_MSG: &str = "Send does not exist or is no longer available";
 static ANON_PUSH_DEVICE: LazyLock<Device> = LazyLock::new(|| {
-    let dt = crate::util::parse_date("1970-01-01T00:00:00.000000Z");
+    let dt = crate::util::parse_date("1970-01-01T00:00:00.000000Z").expect("hardcoded epoch date is always valid");
     Device {
         uuid: String::from("00000000-0000-0000-0000-000000000000").into(),
         created_at: dt,
diff --git a/src/db/models/cipher.rs b/src/db/models/cipher.rs
index edc5f8c9..e1f9f155 100644
--- a/src/db/models/cipher.rs
+++ b/src/db/models/cipher.rs
@@ -398,7 +398,7 @@ impl Cipher {
             3 => "card",
             4 => "identity",
             5 => "sshKey",
-            _ => panic!("Wrong type"),
+            _ => err!(format!("Cipher {} has an invalid type {}", self.uuid, self.atype)),
         };
 
         json_object[key] = type_data_json;
diff --git a/src/util.rs b/src/util.rs
index 182b7b3b..4f150287 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -486,8 +486,11 @@ pub fn format_datetime_http(dt: &DateTime<Local>) -> String {
     expiry_time.to_rfc2822().replace("+0000", "GMT")
 }
 
-pub fn parse_date(date: &str) -> NaiveDateTime {
-    DateTime::parse_from_rfc3339(date).unwrap().naive_utc()
+pub fn parse_date(date: &str) -> Result<NaiveDateTime, crate::Error> {
+    match DateTime::parse_from_rfc3339(date) {
+        Ok(dt) => Ok(dt.naive_utc()),
+        Err(e) => err!(format!("Invalid RFC3339 date '{date}': {e}")),
+    }
 }
 
 /// Returns true or false if an email address is valid or not