fix(security): audit batch A — validation, rate limiting, sessions (#20)

2026-07-02 03:22:17 +02:00
parent 2056548702
commit c5c33f7023
10 changed files with 500 additions and 2 deletions
@@ -7,6 +7,7 @@ namespace InboxIntel.Api.Controllers;
 /// AI endpoints are read-only / advisory. They never trigger destructive
 /// actions - suggestions are returned for the user to act on via /cleanup.
 /// </summary>
+[Microsoft.AspNetCore.RateLimiting.EnableRateLimiting("expensive")]  // AUDIT H-2: LLM calls are the most expensive path
 public class AiController : ApiControllerBase
 {
    private readonly IAiService _ai;