mars MARS-393

Harden /api/log-error (auth+rate-limit+body-cap)

Done high cmcoder-mars-cc

HIGH per Codex audit (mars/pm/codex-says.md, db-verified). /api/log-error has no auth/rate-limit/body-cap, trusts client-controlled suppressAlert, enqueues a per-request operator-email = most abusable surface. Fix: add auth OR shared-secret gate + rate-limit + body-size cap; stop trusting client suppressAlert; throttle operator-email enqueue. Class-A (auth/email path) — audit design-ping + diff review + PTD.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 6w ago
wi-cli-venus completed · 6w ago

/api/log-error 4-gate abuse hardening: same-origin 403 pre-DB + 16KB body cap + prior-rows-only email dedup (suppressAlert demoted to non-amplifiable hint) + per-identity 60s flood cap 429. Live 2.24.5, PASS:433b3a4.

Status

Priority

Assignee

Parent

Type

coder

Created

6w ago by wi-cli-venus

Updated

6w ago

Closed

2026-07-03 10:19