fix(security): resolve CodeQL alerts for rate limiting and NoSQL injection

Author: yash-pouranik

.env.example

@@ -48,4 +48,7 @@ RAZORPAY_KEY_SECRET=xxxxxxxxxxxxxxxxxxxx
 RAZORPAY_PLAN_ID=plan_xxxxxxxxxxxx
 
 # Set from: Razorpay Dashboard → Settings → Webhooks → Add Endpoint → copy secret
-RAZORPAY_WEBHOOK_SECRET=xxxxxxxxxxxxxxxxxxxx
+RAZORPAY_KEY_ID=rzp_testx_xxxx
+RAZORPAY_KEY_SECRET=xxxx
+RAZORPAY_PLAN_ID=xxxx
+RAZORPAY_WEBHOOK_SECRET=xxxx

apps/dashboard-api/src/controllers/billing.controller.js

@@ -101,9 +101,9 @@ module.exports.handleWebhook = async (req, res, next) => {
 
         // Extract developer_id from subscription notes
         const developerId = payload.notes?.developer_id;
-        if (!developerId) {
-            console.warn('Razorpay webhook: no developer_id in notes');
-            return res.json({ success: true, message: 'No developer_id in notes. Skipped.' });
+        if (!developerId || typeof developerId !== 'string') {
+            console.warn('Razorpay webhook: no valid developer_id in notes');
+            return res.json({ success: true, message: 'No valid developer_id in notes. Skipped.' });
         }
 
         const developer = await Developer.findById(developerId);

apps/dashboard-api/src/routes/billing.js

@@ -1,12 +1,13 @@
 const express = require('express');
 const router = express.Router();
 const authMiddleware = require('../middlewares/authMiddleware');
+const { authLimiter, publicLimiter } = require('../middlewares/auth_limiter');
 const { createCheckout, handleWebhook } = require('../controllers/billing.controller');
 
-// Create a Lemon Squeezy checkout session (authenticated)
-router.post('/checkout', authMiddleware, createCheckout);
+// Create a Razorpay checkout session (authenticated)
+router.post('/checkout', authLimiter, authMiddleware, createCheckout);
 
-// Receive webhook events from Lemon Squeezy (public — validated by HMAC signature)
-router.post('/webhook', handleWebhook);
+// Receive webhook events from Razorpay (public — validated by HMAC signature)
+router.post('/webhook', publicLimiter, handleWebhook);
 
 module.exports = router;

tools/db-queries/backfill-developer-plans.js

@@ -1,7 +1,6 @@
 const dotenv = require('dotenv');
 const path = require('path');
 
-// Load environment variables from repo root .env
 dotenv.config({ path: path.join(__dirname, '../../.env') });
 
 const { Developer, connectDB } = require('../../packages/common');