Add

request size limits

app.py

@@ -50,15 +50,27 @@ class ScrubResponse(BaseModel):
     entities_found: int
 
 
+MAX_TURNS = 200
+MAX_CONTENT_LENGTH = 100_000  # 100KB per turn
+
+
 @app.post("/scrub", response_model=ScrubResponse)
 async def scrub(payload: ScrubRequest, x_api_key: str = Header(None)):
     if API_KEY and x_api_key != API_KEY:
         raise HTTPException(status_code=401, detail="Invalid API key")
 
+    if len(payload.turns) > MAX_TURNS:
+        raise HTTPException(status_code=413, detail=f"Too many turns (max {MAX_TURNS})")
+
     total_entities = 0
     scrubbed_turns = []
 
     for turn in payload.turns:
+        if len(turn.get("content", "")) > MAX_CONTENT_LENGTH:
+            raise HTTPException(
+                status_code=413,
+                detail=f"Turn content too large (max {MAX_CONTENT_LENGTH} bytes)",
+            )
         text = turn.get("content", "")
         role = turn.get("role", "")