[CRITICAL] API contributors route has no rate limiting - DoS vulnerability

[saidai-bhuvanesh]

⚠️ Performance: No Rate Limiting on GitHub API Calls

Severity: High
File: src/app/api/contributors/route.js

Problem

Every request hits GitHub API without rate limiting:

const [pullsRes, commitsRes] = await Promise.all([
  fetch("https://api.github.com/repos/.../pulls?...", { cache: "no-store" }),
  fetch("https://api.github.com/repos/.../commits?...", { cache: "no-store" })
]);

Issues

1. No caching: cache: no-store means every request hits GitHub
2. No rate limiting: Can trigger GitHub API rate limits (60 req/hr for unauth)
3. DoS potential: Single user can exhaust API quota

Fix Required

// Add caching
const res = await fetch(url, { 
  next: { revalidate: 300 } // Cache for 5 minutes
});

// Add rate limiting header check
const rateLimit = res.headers.get("x-ratelimit-remaining");
if (rateLimit && parseInt(rateLimit) < 10) {
  return NextResponse.json({ error: "Rate limited" }, { status: 429 });
}

Labels: bug, ssoc26

[github-actions]

Thank you for raising this issue! We'll look into it as soon as possible. Please ensure that the issue is not a duplicate, and read CONTRIBUTING.md carefully before contributing. Your contributions are highly appreciated! 😊

[saidai-bhuvanesh]

/assign

[MistryVishwa]

@saidai-bhuvanesh Assigned. You can start working on this.