Improvement: GitHub API calls have no auth token or rate limit protection (60 req/hr unauthenticated)

[ChitkulLakshya]

Bug: GitHub API calls have no rate limit protection or auth token

File: server/utils/githubAnalyzer.js:122-130

Problem

fetchGitHubRepos calls the GitHub API without authentication:

const response = await fetch(
  `https://api.github.com/users/${username}/repos?per_page=30&sort=updated`,
  {
    headers: {
      Accept: 'application/vnd.github.v3+json',
      'User-Agent': 'LeddgerAI-Analytics',
    },
  }
);

Unauthenticated GitHub API requests are limited to 60 requests/hour per IP. If multiple users have templates with GitHub usernames, a single user analyzing 2 templates with 30+ profiles could exhaust the rate limit for ALL users on the server.

Impact

• 403 rate limit errors after 60 requests/hour (server-wide, not per-user)
• Error is caught but shows "Rate limited" to the user with no retry guidance
• One user's GitHub analysis can block all other users' analysis

Fix

1. Add a GitHub token env var (GITHUB_TOKEN) and include it in headers:

headers: {
  Accept: 'application/vnd.github.v3+json',
  'User-Agent': 'LeddgerAI-Analytics',
  ...(process.env.GITHUB_TOKEN ? { Authorization: `token ${process.env.GITHUB_TOKEN}` } : {}),
}

This raises the limit to 5,000 requests/hour.

2. Add per-request throttling (e.g., 1 request per second) to avoid burst rate limiting.

3. Return a more helpful error message with retry-after guidance when rate limited.

Severity

Medium — Works for small-scale usage but will break under any real load.

Phase

Introduced in Phase 3 (PR #28, merged).