diff --git a/api/replication_job.go b/api/replication_job.go
index ae3d080a3..49db4ccad 100644
--- a/api/replication_job.go
+++ b/api/replication_job.go
@@ -134,6 +134,10 @@ func (ra *RepJobAPI) Delete() {
 		ra.CustomAbort(http.StatusInternalServerError, http.StatusText(http.StatusInternalServerError))
 	}
 
+	if job == nil {
+		ra.CustomAbort(http.StatusNotFound, fmt.Sprintf("job %d not found", ra.jobID))
+	}
+
 	if job.Status == models.JobPending || job.Status == models.JobRunning {
 		ra.CustomAbort(http.StatusBadRequest, fmt.Sprintf("job is %s, can not be deleted", job.Status))
 	}
diff --git a/api/repository.go b/api/repository.go
index 8de2f2bcc..260757538 100644
--- a/api/repository.go
+++ b/api/repository.go
@@ -17,6 +17,7 @@ package api
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"os"
 	"sort"
@@ -210,6 +211,10 @@ func (ra *RepositoryAPI) GetTags() {
 		ra.CustomAbort(http.StatusInternalServerError, "")
 	}
 
+	if project == nil {
+		ra.CustomAbort(http.StatusNotFound, fmt.Sprintf("project %s not found", projectName))
+	}
+
 	if project.Public == 0 {
 		userID := ra.ValidateUser()
 		if !checkProjectPermission(userID, project.ProjectID) {