Summary
No rate limiting exists on:
- OAuth login attempts
- Server Action invocations
- GitHub API proxy calls
While Supabase and GitHub have their own rate limits, the application layer has no protection against brute-force enumeration of board IDs, excessive GitHub API consumption, or denial of service via expensive queries.
Options
- Upstash Ratelimit — Redis-based, Vercel-friendly
- Vercel Edge Config — Built-in to Vercel platform
- Custom middleware in `proxy.ts`
Priority Endpoints
- OAuth login endpoint
- Server Actions with expensive queries (batch updates)
- GitHub API proxy
Source
`claudedocs/analysis-security.md` — A09-1
Summary
No rate limiting exists on:
While Supabase and GitHub have their own rate limits, the application layer has no protection against brute-force enumeration of board IDs, excessive GitHub API consumption, or denial of service via expensive queries.
Options
Priority Endpoints
Source
`claudedocs/analysis-security.md` — A09-1