fix: add resource limit in zen-proxy.mjs (CWE-770)

[anupamme]

The proxy server lacks any rate limiting mechanism. While requestStats tracks metrics for display purposes, no enforcement exists to prevent request flooding. The router processes all incoming requests immediately without throttling or quota checks. The affected code is zen-proxy.mjs:1. This change is the fix I would apply.

Reference: CWE-770

What changed

• zen-proxy.mjs

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

---

Automated security fix by OrbisAI Security

[12errh]

Fair catch — the proxy had no request limiting at all. I didn't take this version because it throttles every route, so the dashboard (which polls /api/status every 4s), /health and the static assets all get 429'd. Self-inflicted outage.

Shipped instead: limiting is scoped to the chat endpoints only, /health and /api/* are never throttled, per-client sliding window, sends Retry-After, and it's off by default (rateLimitMax: 0) so nobody's setup changes silently. Config + env var if you want it on.

[anupamme]

Thanks for addressing this. The main concern was the lack of any enforcement mechanism on the request path, and the new approach addresses that while avoiding throttling of dashboard/health endpoints.

The scoped chat-endpoint limiting, per-client window, Retry-After, and opt-in configuration make sense.