fix: remediate SQL Injection and add rate limiting in src/routes/auth.js

[devin-ai-integration]

Summary

Fixes 3 high-severity SQL injection vulnerabilities (CodeQL alerts #25, #26, #28) in src/routes/auth.js by replacing string interpolation with parameterized queries using better-sqlite3's ? placeholder syntax.

Alert	Endpoint	Query Type	Line
#25	POST /login	SELECT	15–16
#26	POST /reset-password	UPDATE	43
#28	POST /register	INSERT	57

User-supplied values (username, password, email) are now passed as bound parameters to .get() / .run() instead of being interpolated directly into the SQL string.

Updates since last revision

Added express-rate-limit middleware to address 3 additional CodeQL "missing rate limiting" alerts on the same routes:

Endpoint	Window	Max Requests
POST /login	15 min	10
POST /reset-password	15 min	5
POST /register	1 hour	10

This adds express-rate-limit (^8.2.1) as a new dependency. Rate limiters use the default in-memory store, which is sufficient for single-instance deployments.

Review & Testing Checklist for Human

• Verify the ? placeholder binding order matches the intended columns in each of the 3 queries (login SELECT, reset-password UPDATE, register INSERT)
• Confirm the express-rate-limit middleware is correctly placed as the second argument (before the handler) in each router.post() call
• Verify rate limit thresholds are acceptable for your use case (login: 10/15min, reset: 5/15min, register: 10/hr) — defaults may need tuning for production
• Manually test POST /login, POST /reset-password, and POST /register endpoints to confirm they still function correctly with valid inputs, and that rate-limited requests receive a 429 response
• Note: the login failure response still includes debug: \Query executed: ${query}`` — it now safely shows the parameterized template rather than interpolated user values, but still leaks query structure. This is a separate issue (CWE-209) not addressed here.
• Note: the rate limiter uses an in-memory store; if the app is scaled to multiple instances, consider switching to an external store (e.g., rate-limit-redis)

Notes

• No test suite exists in this repo, so there is no automated verification of these changes
• Other flagged vulnerabilities (hardcoded secrets, MD5 hashing, cleartext passwords, missing auth) are out of scope for this PR
• Requested by: @yubin-jee
• Link to Devin run

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

[devin-ai-integration]

Closing due to inactivity for more than 7 days. Configure here.