Find bugs beforeyour users do.

The new `/reset-password` endpoint introduced in this PR accepts unlimited requests per IP address. An attacker can brute-force reset tokens or trigger mass emails at zero cost.

export async function POST(req: Request) {
  const { email } = await req.json()
  await sendResetEmail(email)
  return NextResponse.json({ ok: true })
}

export async function POST(req: Request) {
  const ip = req.headers.get('x-forwarded-for') ?? 'unknown'
  await ratelimit.check(ip, { limit: 5, window: '15m' })
  const { email } = await req.json()
  await sendResetEmail(email)
  return NextResponse.json({ ok: true })
}

Why this fix works: Rate-limit by IP before any processing. A window of 5 requests per 15 minutes is a reasonable default for password reset flows.

The updated `GET /users/:id` handler returns the full Drizzle row including `passwordHash`. Any client that calls this endpoint receives the hash, making offline cracking trivial.

const [user] = await db
  .select()
  .from(users)
  .where(eq(users.id, params.id))

return NextResponse.json(user)

const [user] = await db
  .select({
    id: users.id,
    name: users.name,
    email: users.email,
    plan: users.plan,
  })
  .from(users)
  .where(eq(users.id, params.id))

return NextResponse.json(user)

Why this fix works: Always use explicit column selection when returning user data. Never rely on the caller to strip sensitive fields after the fact.

`fs.writeFile` is called without `await`. On concurrent uploads for the same key the file can be partially written by one request while another reads it, producing corrupted data.

fs.writeFile(filePath, buffer, (err) => {
  if (err) logger.error('write failed', err)
})
return { key: filePath }

await fs.promises.writeFile(filePath, buffer)
return { key: filePath }

Why this fix works: Use the promise-based API and await the write before returning. This ensures callers see a consistent file state and errors surface as exceptions rather than silent log entries.