Bug: No JSON body size limit enables memory-exhaustion DoS #356

Summary

express.json() is called without a limit option, accepting arbitrarily large JSON payloads. An attacker can send multi-gigabyte payloads to exhaust server memory.

Details

• File: �pps/public-api/src/app.js
• �pp.use(express.json()) — no limit parameter
• Default is 100KB in Express, but without explicit limit it may be misconfigured

Impact

An attacker can easily exhaust server memory by sending large JSON payloads, causing a denial of service.

Suggested Fix

Set an explicit limit: �pp.use(express.json({ limit: '1mb' })).