LOW: webhook secret has no max length — 10 MB secret causes CPU DoS on delivery HMAC computation

[walidboulanouar]

Problem

apps/api/src/routes/webhooks.ts line 47:

secret: z.string().min(16, 'secret must be at least 16 characters'),

No .max() bound. A caller can register a webhook with a 10 MB secret. Every outbound delivery calls crypto.subtle.importKey on that secret — CPU-intensive in Workers. With enough endpoints this becomes a DoS on delivery throughput.

Fix

Add .max(512) to the secret schema.

[walidboulanouar]

Verified fixed in commit 7c6747b — webhook secret capped at .max(512) (apps/api/src/routes/webhooks.ts:69).