Address security review findings (SEC-1266)

[sergical]

Summary

• Validate API key format (trim whitespace, reject < 8 chars)
• Add regex validation to dateRangeSchema for known Plausible date formats
• Sanitize error messages: return HTTP status code only, raw API bodies stay in Sentry
• Validate baseUrl is HTTPS to prevent SSRF
• Add max(1024) length bounds to page/goal filter schemas
• Add Cache-Control: no-store and X-Content-Type-Options: nosniff headers
• Add Cloudflare rate limiting (60 req/min per IP)

Test plan

• bun run build passes
• bun run test — all 53 tests pass
• Deploy to staging and verify rate limiting returns 429 after threshold
• Verify invalid baseUrl throws at construction time
• Verify whitespace-only API key returns 401

Addresses SEC-1266

🤖 Generated with Claude Code

[linear-code]

SEC-1266 Custom Plausible MCP installation request

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Date range regex rejects valid Plausible 24h value
  • Added \d+h to dateRangeSchema regex and updated schema messages to include 24h.

Or push these changes by commenting:

@cursor push 38b2b6d6c2

Preview (38b2b6d6c2)

diff --git a/src/schemas.ts b/src/schemas.ts
--- a/src/schemas.ts
+++ b/src/schemas.ts
@@ -58,11 +58,11 @@
 export const dateRangeSchema = z
   .string()
   .regex(
-    /^(\d+d|\d+mo|day|month|year|all|\d{4}-\d{2}-\d{2},\d{4}-\d{2}-\d{2})$/,
-    'Must be "Nd", "Nmo", "day", "month", "year", "all", or "YYYY-MM-DD,YYYY-MM-DD"'
+    /^(\d+d|\d+h|\d+mo|day|month|year|all|\d{4}-\d{2}-\d{2},\d{4}-\d{2}-\d{2})$/,
+    'Must be "Nd", "Nh", "Nmo", "day", "month", "year", "all", or "YYYY-MM-DD,YYYY-MM-DD"'
   )
   .describe(
-    'Date range: "7d", "30d", "12mo", "month", "year", "all", or "YYYY-MM-DD,YYYY-MM-DD"'
+    'Date range: "24h", "7d", "30d", "12mo", "month", "year", "all", or "YYYY-MM-DD,YYYY-MM-DD"'
   );
 
 export const pageSchema = z

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 878909e. Configure here.}