From c99cdfe5625235f9426fb22ff3cb6afbaf12d5b1 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 06:34:49 +0000
Subject: [PATCH 1/2] Security: Enforce Redis for rate limiting in production

Co-authored-by: is0692vs <135803462+is0692vs@users.noreply.github.com>
---
 src/lib/__tests__/rateLimit.test.ts | 8 ++++++++
 src/lib/rateLimit.ts                | 4 ++++
 2 files changed, 12 insertions(+)

diff --git a/src/lib/__tests__/rateLimit.test.ts b/src/lib/__tests__/rateLimit.test.ts
index 864a3123..2e90d369 100644
--- a/src/lib/__tests__/rateLimit.test.ts
+++ b/src/lib/__tests__/rateLimit.test.ts
@@ -35,6 +35,14 @@ describe("RateLimiter", () => {
     });
 
     describe("In-memory Fallback", () => {
+        it("throws in production when fallback is triggered", async () => {
+            const limiter = new RateLimiter(2, 1000);
+            const key = "test-key-prod";
+            process.env.NODE_ENV = "production";
+            await expect(limiter.check(key)).rejects.toThrow("Redis must be configured in production for secure rate limiting.");
+            process.env.NODE_ENV = "test";
+        });
+
         it("allows requests below the limit", async () => {
             const limiter = new RateLimiter(2, 1000);
             const key = "test-key";
diff --git a/src/lib/rateLimit.ts b/src/lib/rateLimit.ts
index 4ea5c6e7..51831691 100644
--- a/src/lib/rateLimit.ts
+++ b/src/lib/rateLimit.ts
@@ -32,6 +32,10 @@ export class RateLimiter {
             return { success, reset };
         }
 
+        if (process.env.NODE_ENV === "production") {
+            throw new Error("Redis must be configured in production for secure rate limiting.");
+        }
+
         // Fallback to in-memory caching
         const now = Date.now();
         this.cleanup(now); // Lazy cleanup

From 99743ccb6cec930c9455da1e11d3a9eec3f6d52b Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 06:39:20 +0000
Subject: [PATCH 2/2] Security: Enforce Redis for rate limiting in production

Co-authored-by: is0692vs <135803462+is0692vs@users.noreply.github.com>
---
 src/lib/__tests__/rateLimit.test.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/lib/__tests__/rateLimit.test.ts b/src/lib/__tests__/rateLimit.test.ts
index 2e90d369..966ded23 100644
--- a/src/lib/__tests__/rateLimit.test.ts
+++ b/src/lib/__tests__/rateLimit.test.ts
@@ -38,9 +38,9 @@ describe("RateLimiter", () => {
         it("throws in production when fallback is triggered", async () => {
             const limiter = new RateLimiter(2, 1000);
             const key = "test-key-prod";
-            process.env.NODE_ENV = "production";
+            vi.stubEnv('NODE_ENV', 'production');
             await expect(limiter.check(key)).rejects.toThrow("Redis must be configured in production for secure rate limiting.");
-            process.env.NODE_ENV = "test";
+            vi.stubEnv('NODE_ENV', 'test');
         });
 
         it("allows requests below the limit", async () => {