Nick SzaunigandClaude Opus 5.5
0899576262
- Public lot lookup: 30 requests/min per IP and only well-formed lot numbers (1-64 chars) reach the database. - SSO callback URL is built from OIDC_REDIRECT_URI instead of the Host header; SSO cookies are cleared with the attributes they were set with. - Logout is rate-limited like the other auth endpoints. - Middleware errors with a 4xx status (body too large, malformed JSON) answer with that status instead of a 500; error log lines carry the path without query string. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>