Fix security vulnerabilities, bugs, and performance issues across codebase

[Copilot]

Comprehensive audit identified hardcoded secrets, timing attack vectors, missing input validation, model config drift, and suboptimal resource usage.

Security

• Sentry DSN leaked in client bundle — moved hardcoded DSN to env vars (NEXT_PUBLIC_SENTRY_DSN, SENTRY_DSN) across instrumentation-client.ts, sentry.server.config.ts, sentry.edge.config.ts
• Timing attack on webhook verification — replaced require("crypto") + === with import crypto + crypto.timingSafeEqual:

  // before
  const crypto = require("crypto");
  return expectedSignature === signature;
  
  // after
  import crypto from "crypto";
  return crypto.timingSafeEqual(Buffer.from(expectedSignature), Buffer.from(signature));

• Unguarded JSON parsing in webhook and messages routes — JSON.parse(body) and request.json() now wrapped in try-catch returning 400
• No message size limit — added z.string().min(1).max(100_000) to messages schema

Bug Fixes

• Placeholder metadata in layout.tsx — still said "Create Next App"
• ?limit=NaN passed to Prisma — parseInt(limit) now clamped to [1, 100] with explicit NaN handling
• Model billing mismatch — MODEL_MULTIPLIERS was missing entries for claude-opus-4.6, claude-haiku-4.5, quasar-alpha, o3-mini that exist in CONVERSATION_MODELS, causing silent fallback to 1x multiplier

Performance

• Font weights — reduced IBM_Plex_Mono from 7 weights to 4 (400-700), added display: "swap"
• Rate limiter allocation — cached Ratelimit instances as singletons instead of constructing per-request
• Silent catch in file DELETE blob cleanup now logs the error

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
moris	Error		Feb 24, 2026 5:06pm

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 87562e390a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use Zod v4 error issues array

In this validation branch, zod is pinned to ^4.2.1 (package.json), where ZodError exposes issues rather than errors; accessing err.errors.map(...) will itself throw when a request body fails schema validation. That means malformed or out-of-range message payloads still bubble into a 500 instead of returning the intended 400 response from this handler.

Useful? React with 👍 / 👎.