From e5c4303a6bfdaf70414284c54964631619af17b9 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Sun, 2 Aug 2026 04:14:16 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 package.json  |  2 ++
 src/server.js | 10 ++++++++++
 2 files changed, 12 insertions(+)

diff --git a/package.json b/package.json
index 0d3acbbb..e9cb0c34 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,9 @@
     "dayjs": "^1.10.6",
     "dotenv": "^10.0.0",
     "ejs": "^3.1.6",
+    "csrf": "^3.1.0",
     "express": "^4.17.1",
+    "express-rate-limit": "^7.0.0",
     "get-caller-file": "^2.0.5",
     "json-server": "^0.17.0",
     "request": "^2.88.2",
diff --git a/src/server.js b/src/server.js
index 5bb909cf..3dc307fa 100644
--- a/src/server.js
+++ b/src/server.js
@@ -1,10 +1,14 @@
 require("dotenv").config();
 const express = require("express");
 const bodyParser = require("body-parser");
+const rateLimit = require("express-rate-limit");
+const csrf = require("csrf");
 const viewEngine = require("./config/viewEngine");
 const initWebRoutes = require("./routes/web");
 const cors = require("cors");
 
+const tokens = new csrf();
+
 // //json server
 // const jsonServer = require('json-server')
 // const server = jsonServer.create()
@@ -20,6 +24,12 @@ const cors = require("cors");
 
 let app = express();
 
+const limiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 100,
+});
+app.use(limiter);
+
 //config view engine
 viewEngine(app);