Commit Graph

9 Commits

Author SHA1 Message Date
Ralksta
f18d9ae3d9 🛡️ Sentinel: [CRITICAL] Fix rate limit DoS vulnerability (#136)
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-04-24 22:12:42 +02:00
Ralksta
006ba539ab fix(rate-limit): mitigate cache flooding vulnerability (#94)
Update in-memory rate limiter to fail secure (reject new requests) when maximum capacity is reached, rather than evicting the oldest tracking entry. This prevents an attacker from bypassing their rate limit by flooding the store with spoofed `x-forwarded-for` IPs to intentionally trigger cache eviction. Also cleaned up temporary files and updated tests to verify the behavior.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-04-21 22:51:46 +02:00
Ralksta
264e48b3cc perf: return Buffer directly instead of wrapping in Uint8Array (#131)
Avoids unnecessary O(N) memory allocation and copy by returning `Buffer.from(...)` directly since Buffer inherits from Uint8Array in Node.js.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-04-21 22:51:19 +02:00
Ralksta
258c36899c fix(auth): secure plaintext password comparison against timing attacks (#68)
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-04-01 12:46:04 +02:00
Ralksta
1704cd87fc ⚡ Bolt: [Deduplicate concurrent album fetches] (#50)
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-03-27 10:50:00 +01:00
Ralksta
43d5b4d15d 🛡️ Sentinel: Add rate limiting to /api/og endpoint (#47)
Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-03-27 10:36:25 +01:00
google-labs-jules[bot]
cdc26c00ac 🛡️ Sentinel: [HIGH] Cache health check endpoint to prevent upstream DoS
Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>
2026-03-20 11:33:38 +00:00
google-labs-jules[bot]
63e6a2f784 🛡️ Sentinel: [HIGH] Fix missing rate limiting on /api/exif/[id]
Co-authored-by: ralksta <16941050+ralksta@users.noreply.github.com>
2026-03-12 11:30:45 +00:00
Ralksta
f3890fc6bc perf: memoize PhotoGrid assets map to prevent re-renders during lightbox navigation [#5]
Extracted the grid mapping logic out of the return block into a `useMemo`
hook depending on `[assets, layout, openLightbox]`. This prevents the
entire photo grid—including complex Next.js `<Image>` and `<FadeIn>`
components—from needlessly re-rendering every time the user navigates
via the lightbox arrows or presses next/prev buttons, which previously
caused `lightboxIndex` to update and trigger a re-render of the entire grid.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
2026-03-11 23:32:40 +01:00