feat: security hardening (rate limiting, validation, bot protection)

[masonlet]

Secures the contact endpoint beyond basic usage.

Changes

• Rate limiting via Vercel WAF (@vercel/firewall)
• Input validation: email format, field length limits (subject: 200, message: 2000)
• Honeypot protection: silent fax_number traps bots, triggers a warning log
• Email header injection prevention: \r\n stripped from subject before sending
• Content-type enforcement: rejects non-application/json requests with 415
• CORS hardening: headers set before rate limit check to ensure correct behaviour
• Input trimming before dispatch

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
contact-api	Ready	Preview, Comment	Mar 14, 2026 7:03pm