perf: DB indexes, eliminate double-query delete, strip hot-path debug logging

[Copilot]

Addresses several performance and security gaps across the stack: missing MongoDB indexes on all queried fields, a redundant round-trip on every delete, and an Axios interceptor leaking auth tokens into console logs on every request.

Database indexes

Three indexes added to schema definitions (before mongoose.model() — after is silently ignored by Mongoose):

userSchema.index({ skills: 1 });                   // searchUsersBySkills $in
projectSchema.index({ owner: 1, createdAt: -1 });  // getUserProjects filter+sort in one pass
projectSchema.index({ techStack: 1 });             // searchProjectsByTech $in

Eliminate double DB round-trip on delete

deleteProject was doing findById (ownership check) → findByIdAndDelete (delete) — two round-trips for a document already in memory:

// Before
await Project.findByIdAndDelete(req.params.id);

// After — reuses already-fetched document
await project.deleteOne();

Strip hot-path debug logging

The Axios request interceptor logged the full config (including Authorization header) on every call; response interceptor logged full payloads. Both removed. 401 redirect logic retained.

Dead client API methods removed

• userAPI.getProfile — exact duplicate of userAPI.getUser
• userAPI.updateUser — called PUT /api/users/:id, a route that has never existed

Rate limiting on DELETE /api/projects/:id

The delete route was the only mutation endpoint without rate limiting. Added mutationLimiter (30 req/min) matching the existing pattern in routes/users.js.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dev-link-up	Ready	Preview, Comment	Apr 4, 2026 10:08am