feat: rate limit public routes; backfill v0.9.5 changelog for mobile audit

Sign-in/sign-up now throttle at 3 req/10s/IP via better-auth's built-in
rate limiter; /r/ and /s/ share links throttle at 60 req/min/IP via
proxy.ts using the existing Redis-backed limiter (Next 16's Proxy always
runs Node.js, no Edge-runtime blocker after all).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to Epicure are documented here. This file is mirrored in-app at `/changelog` (and in the admin dashboard) via `apps/web/lib/changelog.ts` — update both together.
 
+## 0.9.6 — 2026-07-13 09:31
+
+### Added
+- **Rate limiting on public routes**: sign-in/sign-up now throttle after 3 attempts per 10s per IP; public recipe/shopping-list share links (`/r/`, `/s/`) throttle after 60 requests/min per IP.
+
+## 0.9.5 — 2026-07-13 09:20
+
+### Fixed
+- Explore page's "Recipe ideas" input got squeezed to a couple of visible characters on mobile — buttons now stay icon-only below `sm:`.
+- The per-recipe chat button could overlap the private-notes save button on short recipe pages.
+
 ## 0.9.4 — 2026-07-13 09:03
 
 ### Fixed

apps/web/lib/auth/server.ts

@@ -10,6 +10,14 @@ import { gravatarUrl } from "@/lib/gravatar";
 export const auth = betterAuth({
   trustedOrigins: [process.env["BETTER_AUTH_URL"] ?? "http://localhost:3000"],
 
+  // Explicit rather than relying on the isProduction default so dev/staging
+  // are protected too. Sign-in/sign-up/change-password/change-email get a
+  // strict built-in 3-req/10s-per-IP rule (better-auth's default special
+  // rules) — everything else on /api/auth falls back to 100/10s.
+  rateLimit: {
+    enabled: true,
+  },
+
   database: drizzleAdapter(db, {
     provider: "pg",
     schema: { user: users, session: sessions, account: accounts, verification: verifications },

apps/web/lib/changelog.ts

@@ -1,5 +1,5 @@
 // Mirrors CHANGELOG.md at the repo root — update both together.
-export const APP_VERSION = "0.9.4";
+export const APP_VERSION = "0.9.6";
 
 export type ChangelogEntry = {
   version: string;
@@ -11,6 +11,21 @@ export type ChangelogEntry = {
 };
 
 export const CHANGELOG: ChangelogEntry[] = [
+  {
+    version: "0.9.6",
+    date: "2026-07-13 09:31",
+    added: [
+      "**Rate limiting on public routes**: sign-in/sign-up now throttle after 3 attempts per 10s per IP; public recipe/shopping-list share links (`/r/`, `/s/`) throttle after 60 requests/min per IP.",
+    ],
+  },
+  {
+    version: "0.9.5",
+    date: "2026-07-13 09:20",
+    fixed: [
+      "Explore page's \"Recipe ideas\" input got squeezed to a couple of visible characters on mobile — buttons now stay icon-only below `sm:`.",
+      "The per-recipe chat button could overlap the private-notes save button on short recipe pages.",
+    ],
+  },
   {
     version: "0.9.4",
     date: "2026-07-13 09:03",

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epicure/web",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "private": true,
   "scripts": {
     "dev": "next dev",

apps/web/proxy.ts

@@ -1,9 +1,22 @@
 import { NextRequest, NextResponse } from "next/server";
 import { getSessionCookie } from "better-auth/cookies";
+import { applyRateLimit } from "@/lib/rate-limit";
 
 const PUBLIC_PATHS = ["/login", "/signup", "/verify-email", "/forgot-password", "/reset-password", "/api/auth", "/r/", "/u/", "/s/", "/docs", "/api/v1/openapi.json", "/api/webhooks", "/api/v1/invites/", "/api/internal/"];
 const ADMIN_PATHS = ["/admin"];
 
+// Unauthenticated, publicly-linked pages (shared recipes/shopping lists) —
+// no per-user identity to key on, so rate-limit by IP to deter scraping.
+const IP_RATE_LIMITED_PATHS = ["/r/", "/s/"];
+const IP_RATE_LIMIT = 60;
+const IP_RATE_LIMIT_WINDOW_SECONDS = 60;
+
+function getClientIp(request: NextRequest): string {
+  const forwardedFor = request.headers.get("x-forwarded-for");
+  if (forwardedFor) return forwardedFor.split(",")[0]!.trim();
+  return request.headers.get("x-real-ip") ?? "unknown";
+}
+
 export async function proxy(request: NextRequest) {
   const { pathname } = request.nextUrl;
 
@@ -11,7 +24,14 @@ export async function proxy(request: NextRequest) {
   const isAdmin = ADMIN_PATHS.some((p) => pathname.startsWith(p));
   const isApi = pathname.startsWith("/api/v1");
 
-  if (isPublic) return NextResponse.next();
+  if (isPublic) {
+    if (IP_RATE_LIMITED_PATHS.some((p) => pathname.startsWith(p))) {
+      const ip = getClientIp(request);
+      const limited = await applyRateLimit(`rl:public:${ip}`, IP_RATE_LIMIT, IP_RATE_LIMIT_WINDOW_SECONDS);
+      if (limited) return limited;
+    }
+    return NextResponse.next();
+  }
 
   // API-key clients authenticate via `Authorization: Bearer ek_...`, not a
   // session cookie — they'd otherwise be rejected here before ever reaching

package.json

@@ -1,6 +1,6 @@
 {
   "name": "epicure",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "private": true,
   "scripts": {
     "dev": "pnpm --filter web dev",