fix: fix security issue in StatusRoutes.js

[anupamme]

Summary

Fix high severity security issue in src/routes/StatusRoutes.js.

Vulnerability

Field	Value
ID	V-002
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-002
File	src/routes/StatusRoutes.js:52
Assessment	Likely exploitable

Description: The Express application exposes multiple API endpoints without any rate limiting middleware. Endpoints including /health, /api/status, /api/usage-stats, and /api/usage-stats/import accept unlimited requests, enabling resource exhaustion and brute force attacks.

Evidence

Exploitation scenario: An attacker can send thousands of requests per second to any endpoint.

Scanner confirmation: multi_agent_ai rule V-002 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This route handler appears to be publicly accessible. This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• src/routes/StatusRoutes.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

Security Invariant

Property: The security boundary is maintained under adversarial input

Regression test

const express = require("express");
const request = require("supertest");

describe("rate limiting middleware is applied to all public endpoints", () => {
  const testCases = [
    { endpoint: "/health", description: "public health endpoint" },
    { endpoint: "/", description: "root endpoint without auth" },
    { endpoint: "/api/status", description: "status endpoint" },
  ];

  test.each(testCases)(
    "applies rate limiting to $description",
    async ({ endpoint }) => {
      const app = express();
      require("../../src/routes/StatusRoutes")(app);

      const middlewareNames = app._router.stack
        .filter((layer) => layer.handle)
        .map((layer) => layer.handle.name || "anonymous");

      const hasRateLimiter = middlewareNames.some(
        (name) =>
          name.toLowerCase().includes("rate") ||
          name.toLowerCase().includes("limit")
      );

      expect(hasRateLimiter).toBe(true);
    }
  );
});

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security