From dadf5bf7c0f9be9e1d80bfe5fb2ca45765c37338 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 04:27:21 +0000
Subject: [PATCH 1/2] Fix potential Server-Side DoS by adding Authorization
 header to GitHub API call

Co-authored-by: is0692vs <135803462+is0692vs@users.noreply.github.com>
---
 src/app/api/og/[username]/route.tsx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/app/api/og/[username]/route.tsx b/src/app/api/og/[username]/route.tsx
index 0223dd1d..a2baea1c 100644
--- a/src/app/api/og/[username]/route.tsx
+++ b/src/app/api/og/[username]/route.tsx
@@ -44,6 +44,7 @@ export async function GET(
   try {
     const res = await fetch(`https://api.github.com/users/${encodeURIComponent(username)}`, {
       headers: {
+        ...(process.env.GITHUB_TOKEN && { Authorization: `Bearer ${process.env.GITHUB_TOKEN}` }),
         Accept: "application/vnd.github.v3+json",
         "User-Agent": "github-user-summary",
       },

From f54d143f7752f348760662d88d304a2bf912ce92 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 04:33:00 +0000
Subject: [PATCH 2/2] Fix potential Server-Side DoS by adding Authorization
 header to GitHub API call

Co-authored-by: is0692vs <135803462+is0692vs@users.noreply.github.com>
---
 src/app/api/og/[username]/route.test.ts | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/app/api/og/[username]/route.test.ts b/src/app/api/og/[username]/route.test.ts
index edabdca5..8623db9a 100644
--- a/src/app/api/og/[username]/route.test.ts
+++ b/src/app/api/og/[username]/route.test.ts
@@ -42,6 +42,21 @@ describe("OG Image Route", () => {
     expect(await res.text()).toBe("Invalid username");
   });
 
+  it("should generate image for valid username with authorization header when GITHUB_TOKEN is set", async () => {
+    vi.stubEnv('GITHUB_TOKEN', 'test_token');
+    const mockFetch = vi.spyOn(global, "fetch").mockImplementation(() => Promise.resolve(new Response(JSON.stringify({ name: "Valid User" }), { status: 200 })));
+
+    const req = new NextRequest("http://localhost/api/og/validuser");
+    await GET(req, { params: Promise.resolve({ username: "validuser" }) });
+
+    expect(mockFetch).toHaveBeenCalledWith("https://api.github.com/users/validuser", expect.objectContaining({
+      headers: expect.objectContaining({
+        Authorization: "Bearer test_token"
+      })
+    }));
+    vi.unstubAllEnvs();
+  });
+
   it("should generate image for valid username", async () => {
     const mockFetch = vi.spyOn(global, "fetch").mockImplementation(() => Promise.resolve(new Response(JSON.stringify({ name: "Valid User", bio: "Short bio", avatar_url: "https://example.com/avatar.png", followers: 100, public_repos: 50 }), { status: 200 })));