fix(security): add rate limiting to search endpoint

Author: wendev27

checkpoints/checkpoint-19-owasp-security-practices.md

@@ -13,7 +13,7 @@ To answer that question, I explored:
 - OWASP Top 10 risks
 - Secrets management
 - Dependency scanning
-- Static application security testing (SAST)
+- Static Application Security Testing (SAST)
 - Container security
 - Secure CI/CD pipelines
 - Branch protection rules
@@ -26,20 +26,21 @@ OWASP is not a tool.
 
 OWASP is a collection of security risks, best practices, and guidelines that help developers build secure applications.
 
-Many of the tools I practiced throughout Phase 4 exist to mitigate OWASP risks.
+Many of the tools and practices explored throughout Phase 4 exist to mitigate OWASP risks.
 
 ---
 
 # 🔥 OWASP Risks and Their DevSecOps Counterparts
 
-| OWASP Risk                  | Tool / Practice          |
-| --------------------------- | ------------------------ |
-| SQL Injection               | Semgrep, CodeQL          |
-| Sensitive Data Exposure     | `.env`, GitHub Secrets   |
-| Vulnerable Components       | `npm audit`, Trivy       |
-| Security Misconfiguration   | Branch Protection, CI/CD |
-| Broken Access Control       | RBAC                     |
-| Software Integrity Failures | CodeQL, Secure Pipelines |
+| OWASP Risk                  | Tool / Practice                        |
+| :-------------------------- | :------------------------------------- |
+| Injection                   | Semgrep, CodeQL, Parameterized Queries |
+| Sensitive Data Exposure     | `.env`, GitHub Secrets                 |
+| Vulnerable Components       | `npm audit`, Trivy                     |
+| Security Misconfiguration   | Branch Protection, CI/CD               |
+| Broken Access Control       | RBAC                                   |
+| Software Integrity Failures | CodeQL, Secure Pipelines               |
+| Denial of Service (DoS)     | Rate Limiting                          |
 
 ---
 
@@ -56,7 +57,7 @@ labs/security/secrets-lab/
 Practiced:
 
 - Storing secrets inside `.env`
-- Preventing secret leaks with `.gitignore`
+- Preventing secret leaks using `.gitignore`
 - Using GitHub Secrets inside workflows
 
 ---
@@ -100,7 +101,64 @@ Integrated GitHub CodeQL scanning.
 Observed:
 
 - Detection of clear-text logging
-- Security findings inside the Security tab
+- Detection of SQL Injection risks
+- Detection of missing rate limiting on database endpoints
+- Security findings inside the GitHub Security tab
+
+Learned:
+
+- Secure code is not only about preventing SQL Injection.
+- Security tools analyze data flow between application components.
+- API endpoints that access databases should implement rate limiting.
+- Security also includes protecting application availability.
+
+---
+
+## OWASP Practice: SQL Injection and Rate Limiting
+
+Created:
+
+```text
+labs/security/owasp-lab/
+```
+
+Practiced:
+
+- Writing intentionally vulnerable SQL queries
+- Detecting SQL Injection using CodeQL
+- Fixing vulnerabilities using parameterized queries
+- Protecting endpoints with `express-rate-limit`
+
+Vulnerable query:
+
+```javascript
+const sql = `SELECT * FROM users WHERE name = '${query}'`;
+```
+
+Secure query:
+
+```javascript
+const [rows] = await db.execute('SELECT * FROM users WHERE name = ?', [query]);
+```
+
+Added rate limiting:
+
+```javascript
+const rateLimit = require('express-rate-limit');
+
+const limiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 100,
+});
+
+app.use(limiter);
+```
+
+Learned:
+
+- User input should never be directly concatenated into SQL queries.
+- Databases should receive queries and parameters separately.
+- Public endpoints should implement rate limiting to prevent denial-of-service attacks.
 
 ---
 
@@ -110,13 +168,14 @@ Commands:
 
 ```bash
 trivy image my-first-image
+
 trivy image node:24-slim
 ```
 
 Learned:
 
-- Containers inherit vulnerabilities from base images.
-- Smaller images reduce attack surface.
+- Containers inherit vulnerabilities from their base images.
+- Smaller images reduce the attack surface.
 - Security is not only about application code.
 
 ---
@@ -160,23 +219,25 @@ Security is not a single tool.
 
 Modern DevSecOps combines:
 
+```text
 Developer
-↓
+    ↓
 Secrets Management
-↓
+    ↓
 Dependency Scanning
-↓
+    ↓
 SAST
-↓
+    ↓
 CodeQL
-↓
+    ↓
 Container Security
-↓
+    ↓
 Secure CI/CD
-↓
+    ↓
 Branch Protection
-↓
+    ↓
 Deployment
+```
 
 OWASP provides the security model that connects all of these layers.
 
@@ -188,28 +249,23 @@ Before this checkpoint, I viewed security as individual tools and isolated vulne
 
 After completing Phase 4, I understand that modern application security is a chain of defenses that protects code before it reaches production.
 
+I also learned that security is not limited to preventing SQL Injection or protecting secrets. Modern applications must also defend against denial-of-service attacks, insecure dependencies, vulnerable containers, and unsafe deployment pipelines.
+
 ---
 
 # 🚀 Phase 4 Complete
 
 Completed:
 
-✅ Environment Variables & Secrets Management
-
-✅ Dependency Scanning
-
-✅ SAST
-
-✅ CodeQL
-
-✅ Trivy Container Scanning
-
-✅ Container Security
-
-✅ Secure CI/CD Pipelines
-
-✅ OWASP Security Practices
+- ✅ Environment Variables & Secrets Management
+- ✅ Dependency Scanning
+- ✅ SAST
+- ✅ CodeQL
+- ✅ Trivy Container Scanning
+- ✅ Container Security
+- ✅ Secure CI/CD Pipelines
+- ✅ OWASP Security Practices
 
 The next step is:
 
-🌐 Phase 5 — Infrastructure
+🌐 **Phase 5 — Infrastructure**