fix(security): audit batch A — validation, rate limiting, sessions (#20)

2026-07-02 03:22:17 +02:00
parent 2056548702
commit c5c33f7023
10 changed files with 500 additions and 2 deletions
@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Mvc;

 namespace InboxIntel.Api.Controllers;

+[Microsoft.AspNetCore.RateLimiting.EnableRateLimiting("expensive")]  // AUDIT H-2: triggers server-side outbound HTTP
 public class UnsubscribeController : ApiControllerBase
 {
    private readonly IUnsubscribeService _unsub;