Add route-level rate limiting to settings endpoints to resolve CodeQL alert

[Copilot]

This PR addresses the code scanning finding on backend/routes/settingsRoutes.js by adding recognized rate limiting to settings handlers that perform auth + DB access. The change is intentionally narrow and focused on the flagged route surface.

• Scope: settings route hardening

  • Added express-rate-limit as a backend dependency.
  • Introduced a shared limiter for settings routes (60s window, 30 requests).
  • Applied limiter in backend/routes/settingsRoutes.js to both:
    • GET /
    • PUT /

• Implementation detail

  • Replaced custom in-repo middleware approach with express-rate-limit middleware so static analysis can reliably detect and validate rate limiting.

const settingsRateLimit = rateLimit({
  windowMs: 60 * 1000,
  limit: 30,
  standardHeaders: true,
  legacyHeaders: false
});

router.get('/', settingsRateLimit, auth, getSettings);
router.put('/', settingsRateLimit, auth, updateSettings);

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
attendly-ai	Ready	Preview	Sep 5, 2026 10:27am UTC