fix(security): rate-limit the public non-member apply route

[sacha-l]

Summary

Adds a tight per-IP rate limit to the public, unauthenticated POST /:slug/applications/non-member route, which emails the team (info@ cc sacha@) on every call.

Before, it was only covered by the global limiter (200/min), so one IP could flood the team inbox. Now: 5 requests per 15 min per IP on this route only.

Why this is the only app-level spam surface worth tightening

• It can not be used to spam arbitrary third parties — recipients are fixed (the applicant's address only appears in the email body), so it's not an open relay. Worst case was flooding our own inbox.
• All admin email triggers (program-admin invite, etc.) are already auth-gated.
• Magic-link sign-in emails are sent + rate-limited by Supabase, not this server.

Change

• server/api/routes/program.routes.js: new nonMemberApplyLimiter (express-rate-limit, already a dep) applied to the non-member route. Generous for a real applicant (incl. retries), tight enough to kill a flood.

Test plan

• npm test — 36 files, 291 pass (no regressions).
• Manual: 6th submission from one IP within 15 min returns 429 with the friendly message.

Related hardening (not in this PR — yours)

• Enable CAPTCHA (Turnstile/hCaptcha) on Supabase Auth to stop automated magic-link abuse.
• Add a DMARC DNS record for joinwebzero.com.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stadium	Ready	Preview, Comment	May 22, 2026 4:58pm