Improvement: No rate limiting or streaming on analytics export endpoints (OOM risk on large datasets)

[ChitkulLakshya]

Improvement: No rate limiting on analytics export endpoints (large export can OOM server)

File: server/index.js (Phase 5 PR #30 — export endpoints)

Problem

The export endpoints fetch all data and generate CSV/JSON in memory:

• GET /api/analytics/export/overview.csv — fetches all templates, trends, type distribution
• GET /api/analytics/templates/:draftId/export.csv — fetches up to 10,000 submissions

No rate limiting or size limits. A user with thousands of submissions could trigger an export that consumes significant memory building the CSV string in memory.

Impact on 512MB Render plan

With ~113MB baseline, a large export (10,000 submissions × ~1KB each = ~10MB CSV string) is manageable. But concurrent exports from multiple users could spike memory.

Fix

1. Add rate limiting (e.g., 1 export per 30 seconds per user)
2. For large exports, use streaming responses instead of building the full string in memory
3. Add a max submission count for CSV export (e.g., 5,000) with a warning

Severity

Low — Only an issue with very large datasets or concurrent exports. Not a problem for typical usage.

Phase

Introduced in Phase 5 (PR #30, open).