Pagination on list endpoints

Unpaginated list endpoints are a denial-of-service waiting to happen: as data grows, findMany({}) with no take fetches every record in the table into memory, exhausting database connection pool, server RAM, and response bandwidth simultaneously. This maps directly to CWE-770 (allocation of resources without limits) and OWASP API 2023 API4 (unrestricted resource consumption). A single authenticated request can trigger minutes of database load. Cost-per-request grows linearly with data, making unbounded lists a latent cost bomb in addition to a reliability risk.

Add offset-based or cursor-based pagination to every list endpoint in app/api/. Accept page and limit query params, enforce a maximum page size, and include pagination metadata in the response:

const page = Number(searchParams.get('page') ?? 1)
const limit = Math.min(Number(searchParams.get('limit') ?? 20), 100)
const skip = (page - 1) * limit

const [items, total] = await Promise.all([
  db.post.findMany({ skip, take: limit }),
  db.post.count(),
])

return apiSuccess({ items, meta: { page, limit, total } })

For high-volume tables, replace offset pagination with cursor-based pagination (pass the last record's id as a cursor) to avoid offset drift and index scans.