fix: all three public api endpoints (send-review, co... in route.js

[anupamme]

Summary

Fix high severity security issue in app/api/send-review/route.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	app/api/send-review/route.js:1
Assessment	Likely exploitable
Chain Complexity	3-step

Description: All three public API endpoints (send-review, contact, auth) lack any server-side rate limiting. An attacker can send unlimited requests to these endpoints. The /api/send-review and /api/contact endpoints trigger outbound email sending on every request, making them particularly susceptible to email bombing/spam abuse. The /api/auth endpoint, while protected by Turnstile CAPTCHA, has no fallback rate limiting if the CAPTCHA is bypassed.

Evidence

Exploitation scenario: An attacker who has network access to the application can send high-frequency POST requests to /api/send-review or /api/contact to exhaust the Gmail SMTP quota and cause email flooding.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This API endpoint appears to be publicly accessible. This is a web application - XSS and injection vulnerabilities can affect end users.

Changes

• app/api/send-review/route.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

Automated security fix by OrbisAI Security

[vercel]

@anupamme is attempting to deploy a commit to the Ecma Projects Team on Vercel.

A member of the Team first needs to authorize it.