Severity: HIGH — Resource Exhaustion / DoS
File: src/bot/rate-limiter.ts
The PluginRateLimiter stores timestamps per plugin:action key with no TTL or periodic cleanup. Under sustained load from many unique plugin/action combinations, memory grows unbounded.
Impact: Memory exhaustion under sustained or deliberate high-volume traffic. An attacker can create many unique keys to force unbounded growth.
Fix: Add a periodic cleanup interval (e.g., every 5 minutes) that removes entries older than the tracking window. Consider using a TTL-based Map or LRU cache.
Part of comprehensive security audit (issue #44).
Severity: HIGH — Resource Exhaustion / DoS
File: src/bot/rate-limiter.ts
The PluginRateLimiter stores timestamps per plugin:action key with no TTL or periodic cleanup. Under sustained load from many unique plugin/action combinations, memory grows unbounded.
Impact: Memory exhaustion under sustained or deliberate high-volume traffic. An attacker can create many unique keys to force unbounded growth.
Fix: Add a periodic cleanup interval (e.g., every 5 minutes) that removes entries older than the tracking window. Consider using a TTL-based Map or LRU cache.
Part of comprehensive security audit (issue #44).