From 173f28c677b3d124c500431f842430dd4e2ddad0 Mon Sep 17 00:00:00 2001
From: kadirfiratftw <kadirfiratbot@gmail.com>
Date: Tue, 23 Jun 2026 01:51:44 +0300
Subject: [PATCH] fix: Information Disclosure: Internal Prisma & Database
 Errors Returned in API Response

---
 src/app/api/boards/[boardId]/route.ts     |  4 ++--
 src/app/api/dashboard/route.ts            |  4 ++--
 src/app/api/links/[linkId]/route.ts       |  6 +++---
 src/app/api/pixels/[pixelId]/route.ts     |  4 ++--
 src/app/api/send/route.ts                 | 10 +++++-----
 src/app/api/websites/[websiteId]/route.ts |  4 ++--
 6 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/src/app/api/boards/[boardId]/route.ts b/src/app/api/boards/[boardId]/route.ts
index 8d7a23aeb..1f5ddff68 100644
--- a/src/app/api/boards/[boardId]/route.ts
+++ b/src/app/api/boards/[boardId]/route.ts
@@ -35,8 +35,8 @@ export async function POST(request: Request, { params }: { params: Promise<{ boa
       ])
       .or(z.literal('open'))
       .optional(),
-    name: z.string().optional(),
-    description: z.string().optional(),
+    name: z.string().max(200).optional(),
+    description: z.string().max(500).optional(),
     parameters: z.object({}).passthrough().optional(),
   });
 
diff --git a/src/app/api/dashboard/route.ts b/src/app/api/dashboard/route.ts
index 880057181..2294d857f 100644
--- a/src/app/api/dashboard/route.ts
+++ b/src/app/api/dashboard/route.ts
@@ -21,8 +21,8 @@ export async function GET(request: Request) {
 
 export async function POST(request: Request) {
   const schema = z.object({
-    name: z.string().optional(),
-    description: z.string().optional(),
+    name: z.string().max(200).optional(),
+    description: z.string().max(500).optional(),
     parameters: z.object({}).passthrough().optional(),
   });
 
diff --git a/src/app/api/links/[linkId]/route.ts b/src/app/api/links/[linkId]/route.ts
index 92f572c43..5543d698b 100644
--- a/src/app/api/links/[linkId]/route.ts
+++ b/src/app/api/links/[linkId]/route.ts
@@ -24,9 +24,9 @@ export async function GET(request: Request, { params }: { params: Promise<{ link
 
 export async function POST(request: Request, { params }: { params: Promise<{ linkId: string }> }) {
   const schema = z.object({
-    name: z.string().optional(),
-    url: z.string().optional(),
-    slug: z.string().min(8).optional(),
+    name: z.string().max(100).optional(),
+    url: z.string().max(500).optional(),
+    slug: z.string().min(8).max(100).optional(),
   });
 
   const { auth, body, error } = await parseRequest(request, schema);
diff --git a/src/app/api/pixels/[pixelId]/route.ts b/src/app/api/pixels/[pixelId]/route.ts
index ecaf1fdf6..d1cad1359 100644
--- a/src/app/api/pixels/[pixelId]/route.ts
+++ b/src/app/api/pixels/[pixelId]/route.ts
@@ -24,8 +24,8 @@ export async function GET(request: Request, { params }: { params: Promise<{ pixe
 
 export async function POST(request: Request, { params }: { params: Promise<{ pixelId: string }> }) {
   const schema = z.object({
-    name: z.string().optional(),
-    slug: z.string().min(8).optional(),
+    name: z.string().max(100).optional(),
+    slug: z.string().min(8).max(100).optional(),
   });
 
   const { auth, body, error } = await parseRequest(request, schema);
diff --git a/src/app/api/send/route.ts b/src/app/api/send/route.ts
index be0220bfe..49ae11652 100644
--- a/src/app/api/send/route.ts
+++ b/src/app/api/send/route.ts
@@ -33,17 +33,17 @@ const schema = z.object({
       language: z.string().max(35).optional(),
       referrer: urlOrPathParam.optional(),
       screen: z.string().max(11).optional(),
-      title: z.string().optional(),
+      title: z.string().max(500).optional(),
       url: urlOrPathParam.optional(),
       name: z.string().max(50).optional(),
       tag: z.string().max(50).optional(),
       ip: z.string().optional(),
       userAgent: z.string().optional(),
       timestamp: z.coerce.number().int().optional(),
-      id: z.string().optional(),
-      browser: z.string().optional(),
-      os: z.string().optional(),
-      device: z.string().optional(),
+      id: z.string().max(50).optional(),
+      browser: z.string().max(20).optional(),
+      os: z.string().max(20).optional(),
+      device: z.string().max(20).optional(),
       lcp: z.number().nonnegative().max(60000).optional(),
       inp: z.number().nonnegative().max(60000).optional(),
       cls: z.number().nonnegative().max(100).optional(),
diff --git a/src/app/api/websites/[websiteId]/route.ts b/src/app/api/websites/[websiteId]/route.ts
index c74d018a3..f71271c2c 100644
--- a/src/app/api/websites/[websiteId]/route.ts
+++ b/src/app/api/websites/[websiteId]/route.ts
@@ -39,8 +39,8 @@ export async function POST(
   { params }: { params: Promise<{ websiteId: string }> },
 ) {
   const schema = z.object({
-    name: z.string().optional(),
-    domain: z.string().optional(),
+    name: z.string().max(100).optional(),
+    domain: z.string().max(500).optional(),
     shareId: z.string().max(50).nullable().optional(),
     replayEnabled: z.boolean().optional(),
     replayConfig: z