fix: add rate limiting to /api/profile to prevent DoS amplification

package.json

@@ -35,6 +35,7 @@
     "@vercel/analytics": "^1.6.1",
     "dotenv": "^17.2.3",
     "express": "^4.22.2",
+    "express-rate-limit": "^7.5.1",
     "mongoose": "^9.1.6"
   },
   "devDependencies": {

src/server.js

@@ -1,3 +1,4 @@
+import rateLimit from 'express-rate-limit';
 import express from 'express';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
@@ -7,13 +8,15 @@ import profileRoute from './routes/profile.route.js';
 import themeComparisonRoute from './routes/theme-comparison.route.js';
 import { initializeAnalytics } from './services/analytics.service.js';
 import { githubCache } from './utils/cache.js';
+import { renderGracefulError } from './renderers/error.renderer.js';
 
 inject();
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
 const app = express();
+app.set('trust proxy', 1);
 const PORT = config.port;
 
 // render html file
@@ -45,7 +48,36 @@ app.get('/api/cache/stats', (req, res) => {
   res.json(githubCache.getStats());
 });
 
-app.use('/api/profile', profileRoute);
+function sendRateLimitSvg(req, res) {
+  res.setHeader('Content-Type', 'image/svg+xml');
+  const svg = renderGracefulError({
+    code: 'RATE_LIMIT',
+    detail: 'Too many requests. Please try again in 15 seconds.',
+  });
+  res.status(429).send(svg);
+}
+
+const globalLimiter = rateLimit({
+  windowMs: 15 * 1000,
+  max: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: sendRateLimitSvg,
+});
+
+const usernameLimiter = rateLimit({
+  windowMs: 15 * 1000,
+  max: 10,
+  keyGenerator: (req) => {
+    const username = typeof req.query.username === 'string' ? req.query.username.trim().toLowerCase() : '';
+    return username || req.ip;
+  },
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: sendRateLimitSvg,
+});
+
+app.use('/api/profile', globalLimiter, usernameLimiter, profileRoute);
 app.use('/api/theme-preview', themeComparisonRoute);
 
 // Theme Comparison page