[Security] Medium issues: error leaks, no rate limiting, weak defaults, no password policy

[willamhou]

Severity: MEDIUM (7 items)

Grouped medium-severity issues for batch resolution:

1. Error details leaked in API responses

• src/app/api/search/route.ts:101, compress/route.ts:234, admin/analytics/route.ts:55, content/route.ts:111
• Return generic errors to clients, log details server-side

2. Default admin credentials admin123 in .env.example

• Generate random values in setup scripts, or refuse known defaults in production

3. No rate limiting on main API routes

• /api/context/load, /api/auth/login, /api/auth/register, /api/auth/send-code
• IM server has rate limiting, BFF layer does not

4. Default webhook secret dev-webhook-secret

• src/im/config.ts:48
• Require WEBHOOK_SECRET in production

5. No password strength validation

• src/lib/db-auth.ts:86-116 accepts any password
• Add minimum 8 chars + complexity check

6. Image proxy default allows localhost

• src/app/api/parse/image-proxy/route.ts:3
• Remove localhost from production defaults

7. API key cache unbounded

• src/lib/api-guard.ts:62-88 — cache cleanup only at 1000 entries
• Use LRU cache with hard size limit