SnapOtter ae4fc1decf fix(security): explicit per-route rate limits (CodeQL js/missing-rate-limiting) ...

All /api/ routes are already covered by the global @fastify/rate-limit
(index.ts:283), but CodeQL doesn't model the global registration and flagged
every route without an explicit per-route limit. Added tuned config.rateLimit
to 45 routes: stricter on auth/credential routes (mfa/saml/oidc/api-keys,
15-30/min), moderate on writes (60/min), generous on reads/polls (300/min =
the global default). Real defense-in-depth on sensitive routes. 3 alerts on
non-route code (a preHandler hook, the rate-limiter's own DB lookup, a test
helper) are documented false-positives covered by the global limiter.

2026-06-21 11:49:02 +08:00

..

api

fix(security): explicit per-route rate limits (CodeQL js/missing-rate-limiting)

2026-06-21 11:49:02 +08:00

demo

feat!: SnapOtter 2.0.0

2026-06-17 14:33:09 +08:00

docs

feat(modality): rename "file" modality label "Data" -> "Files"

2026-06-21 02:45:56 +08:00

landing

fix(e2e,landing): robust path escaping (CodeQL) + unique file-tools card

2026-06-21 03:25:45 +08:00

web

feat(modality): rename "file" modality label "Data" -> "Files"

2026-06-21 02:45:56 +08:00