Problem
Only /api/scrape and /api/account/import have explicit request-size checks. Ordinary authenticated JSON endpoints accept unbounded strings and arrays for applications, criteria, résumé data, and LLM settings.
Impact
A tenant can persist very large rows, build very large poller profiles, produce huge LLM prompts, or drive high memory/CPU use through normal authenticated endpoints.
References
api/ApplyTrack.Api/Program.cs — body caps only for scrape/importapi/ApplyTrack.Api/Data/AppFields.csapi/ApplyTrack.Api/Data/Criteria.csapi/ApplyTrack.Api/Data/Resume.cs
Acceptance criteria
- Global JSON body size limit for API routes.
- Field length caps for application fields and notes.
- List/cardinality caps for criteria keywords, excluded locations, ATS boards, résumé experience, highlights, links, skills, and certifications.
- Clear 400 responses when limits are exceeded.
- Tests cover boundary and over-limit cases.
Problem
Only
/api/scrapeand/api/account/importhave explicit request-size checks. Ordinary authenticated JSON endpoints accept unbounded strings and arrays for applications, criteria, résumé data, and LLM settings.Impact
A tenant can persist very large rows, build very large poller profiles, produce huge LLM prompts, or drive high memory/CPU use through normal authenticated endpoints.
References
api/ApplyTrack.Api/Program.cs— body caps only for scrape/importapi/ApplyTrack.Api/Data/AppFields.csapi/ApplyTrack.Api/Data/Criteria.csapi/ApplyTrack.Api/Data/Resume.csAcceptance criteria