Problem
A multi-kilobyte comment handle is accepted and stored, while submit/edit paths cap handles at 64 chars. Inconsistent and abusable.
Where
app/api/comments/route.ts (trim only, no max) vs lib/schemas/submit.ts (.max(64)).
Acceptance
Add a failing test first posting a 500-char handle, expecting 400 instead of 201. Then fix.
Problem
A multi-kilobyte comment handle is accepted and stored, while submit/edit paths cap handles at 64 chars. Inconsistent and abusable.
Where
app/api/comments/route.ts(trim only, no max) vslib/schemas/submit.ts(.max(64)).Acceptance
Add a failing test first posting a 500-char handle, expecting 400 instead of 201. Then fix.