Fixes from adversarial review (17 confirmed findings): - F1/F6: Replace unbounded counter with 60s sliding window (timestamps with eviction) - F3/F8: Remove undefined logRequest call and its empty catch block - F7: Stop echoing unsanitized userId in response (XSS vector) - F14: Return HTTP 429 instead of 200 on rate limit - F13: Export reset() for test isolation - F2/F4/F5/F10/F11/F12: Add boundary, multi-user, and status code tests to smoke.test.js |
||
|---|---|---|
| .gc | ||
| README.md | ||
| package.json | ||
| ratelimit.js | ||
| smoke.test.js | ||
| validator.js | ||
README.md
gc-devops-test
line for pr