aids-server

The server implements strong input validation using Zod schemas for all JSON-RPC requests, preventing malformed inputs and potential injection attacks. Host header validation is in place to prevent injection. Rate limiting (100 requests/minute/IP) is implemented, mitigating basic DoS attacks, but it is in-memory and resets on serverless cold starts, making it less robust for persistent, distributed attacks. CORS allows all origins ('*'), which is acceptable for a public API but could be tightened if specific client origins are known. No hardcoded secrets or 'eval' usage were identified.