fix: the application exposes two public api endpoint... in server.js

[anupamme]

Summary

Fix high severity security issue in server.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	server.js:49
Assessment	Likely exploitable

Description: The application exposes two public API endpoints (/api/health and /api/contact) without any rate limiting middleware. An attacker can send an unlimited number of requests to exhaust server resources, causing denial of service. The /api/contact endpoint is particularly vulnerable as it triggers email sending operations, which are resource-intensive and can be abused to spam the SMTP server or exhaust the application's connection pool.

Evidence

Exploitation scenario: An attacker uses a tool like Apache Bench or curl in a loop to send hundreds of requests per second to /api/contact.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• package.json
• server.js

Behavior Preservation

The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

Automated security fix by OrbisAI Security

[vercel]

@anupamme is attempting to deploy a commit to the sidd developer Team on Vercel.

A member of the Team first needs to authorize it.