This repository was archived by the owner on Jun 4, 2026. It is now read-only.
Fixed security#3345
Open
Originalckjha wants to merge 2 commits into
Open
Conversation
Security: - Add in-memory rate limiter middleware (100 req/15 min per IP) on all /api routes - Restrict CORS to configured allowed origins with explicit method/header allowlist - Set X-Content-Type-Options, X-Frame-Options, X-XSS-Protection response headers - Enforce 10 KB JSON body size limit to block large-payload attacks - Validate and restrict file uploads to JPEG/PNG/WebP/GIF, max 5 MB - Validate MongoDB ObjectId format before hitting the DB in getBlog - Strip internal error objects from all 500 responses (no stack traces to client) - Fix Flask running with debug=True; now reads FLASK_DEBUG env var (defaults off) Validation & correctness: - Add input length and format validation in all four controllers - Add duplicate-email check in newsletter subscription (returns 409) - Add model-level maxlength constraints to match controller limits - Add lowercase + unique index to Newsletter email field - Fix newsletter controller returning wrong "Contact form" success message - Replace placeholder getContact / getNewsletter stubs with 405 responses Performance: - Add cursor-based pagination (page/limit) to getAllBlog and getAllFeedback - Run DB count and find queries concurrently with Promise.all - Fire email sends asynchronously so they don't block HTTP responses Frontend: - Remove duplicate AOS CSS import (was loaded 3 times) - Fix broken backslash path in preloader.css link - Remove JS comment from <script type="application/ld+json"> (invalid JSON) - Remove duplicate <meta name="description"> tag - Add loading="lazy" to all below-the-fold images - Add missing alt text to hero image and decorative images - Remove two debug console.log calls left in subscribe.js https://claude.ai/code/session_01WYySXKUwHPqy48PB1b7PAa
Improve security, performance, and code quality across the stack
|
Thank you for submitting your chaotic pull request! 🙌 We'll review it as soon as possible. In the meantime, please ensure that your changes align with our chaotic CONTRIBUTING.md. If there are any specific instructions or feedback regarding your PR, we'll provide them here. Thanks again for your contribution! 😊 |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🛠️ Fixes Issue
Fixes: #<issue_number>
👨💻 Description
What does this PR do?
📄 Type of Change
📷 Screenshots/GIFs (if any)
Include screenshots or GIFs to demonstrate your changes
✅ Checklist
Mandatory Tasks
🤝 GSSoC Participation