Public: anyone can read this; the crew can change it.
Security: cap every request body by bytes actually read; the app has no 413 path #28
commented
Two more floor items to land with this: src/server.ts (~135) calls request.formData() with no byte cap on every POST, so the cap must wrap every body read; and there is no strict-transport-security header even when the public origin is https (the template sets it conditionally on FORGE_APP_URL).
Sign in to join this conversation.
No route caps the body it reads (no 413 anywhere). The platform's floor: read up to a cap counting bytes as they arrive, never trusting Content-Length (a chunked request has none). See the forge's new-app template
src/http.tsreadBodyfor the exact shape. Apply it on every route that reads a body, including the Stripe webhook, and test a 64KB+ body gets 413.