[Backend] No explicit request body-size limit configured on express.json(); relies on undocumented 100kb default with no 413 handling test

[grantfox-oss]

Telegram (ask questions / claim the issue here first): https://t.me/+DOylgFv1jyJlNzM0

Why this matters

backend/src/app.ts:118 calls express.json() with no limit option, so protection depends entirely on body-parser's implicit 100kb default. The limit is never stated or documented, and the audit-log middleware persists the full req.body to Postgres (auditLog.ts:90-94), so request size directly drives DB write size. There is no test asserting oversized payloads are rejected.

Acceptance criteria

• Set an explicit limit on express.json() (e.g. express.json({ limit: 100kb })) sized to the largest legitimate payload
• Verify oversized requests return 413 through the central error handler with a structured error code
• Document the configured request-size limit
• Add a test asserting a payload over the limit is rejected with 413

Files to touch

• backend/src/app.ts

Out of scope

• Per-route size overrides
• Streaming/multipart upload handling

[Kappa16]

@Kappa16 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Please maintainer..I can handle this professionally and make sure this issue is closed ASAP WITHOUT ERRORS.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Kappa16 to this issue.

[SharifIbrahimDev]

@SharifIbrahimDev has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @SharifIbrahimDev to this issue.

[khanavi272-spec]

@khanavi272-spec has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @khanavi272-spec to this issue.

[drips-wave]

Congratulations, @SharifIbrahimDev! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @SharifIbrahimDev: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[grantfox-oss]

🦊 GrantFox — @SharifIbrahimDev has been assigned to this issue!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #1184)
2. Your PR will be reviewed by the LabsCrypt maintainers

Good luck! Track your progress on GrantFox.