security: harden API routes

- Add rate limiting to /api/share (30/min), /api/export (5/hr),
  /api/account/data (3/day)
- Add client-side 30s throttle to forgot-password form
- Remove immediate tier upgrade on plan change; let invoice.paid
  webhook handle tier promotion to prevent free upgrades on payment
  failure
- Add SSRF validation to webhook URLs: block localhost, private IPs,
  link-local, and metadata endpoints
- Log Stripe webhook signature verification errors instead of
  swallowing silently
- Mask webhook secret in GET response (show first/last 4 chars only)
- Add error logging to API key last_used_at update
- Remove internal error message leaking from checkout session route

1 files changed, 2 insertions, 1 deletions

diff --git a/apps/web/app/api/billing/webhook/route.ts b/apps/web/app/api/billing/webhook/route.ts
index 37944c2..285afdc 100644
--- a/apps/web/app/api/billing/webhook/route.ts
+++ b/apps/web/app/api/billing/webhook/route.ts
@@ -156,7 +156,8 @@ export async function POST(request: Request) {
       signature,
       process.env.STRIPE_WEBHOOK_SECRET!
     )
-  } catch {
+  } catch (verificationError) {
+    console.error("stripe webhook signature verification failed:", verificationError)
     return NextResponse.json({ error: "invalid signature" }, { status: 400 })
   }