Data export rate-limited to prevent harvesting abuse

An unthrottled data export endpoint is an unauthenticated bulk-data harvesting vector. A malicious actor with a valid session token — or a compromised account — can trigger unlimited export jobs, each generating a complete archive of user PII. CWE-770 (allocation of resources without limits) applies directly. Even without malicious intent, runaway export requests can exhaust database connections and background job queues. OWASP A05:2021 (Security Misconfiguration) includes absent rate limiting on sensitive endpoints.

Enforce a per-user quota on export requests using Redis or a data_export_jobs table with a lookback window. In your export route (src/app/api/account/export/route.ts):

async function checkExportQuota(userId: string) {
  const recentExport = await db.dataExportJob.findFirst({
    where: {
      userId,
      requestedAt: { gte: new Date(Date.now() - 24 * 60 * 60 * 1000) }
    }
  });
  if (recentExport) {
    throw new TooManyRequestsError('Export quota: 1 per 24 hours. Try again tomorrow.');
  }
}

Return HTTP 429 with a Retry-After header so API clients handle the limit gracefully. Document the quota in the user-facing help text on the export UI.