[ECSoC_2026] Security: Implement Upstash Redis Rate Limiting on LLM routes

[Diwakar-odds]

Summary

Since the application connects to paid LLM endpoints (OpenRouter/Groq), unprotected API routes (/api/chat, etc.) are vulnerable to abuse or scraping, which can quickly drain API credits.

Proposed Changes

1. Since the project already uses Upstash Redis (per the .env.example), I will implement @upstash/ratelimit.
2. Add rate limiting middleware to the API routes, restricting users to a sensible quota (e.g., 10 requests per minute per IP or authenticated User ID).

I'm highly interested in building out this backend security layer. Could you assign me?

[PrathamReddy888]

Hey, I would like to work on this issue as a part of ECSoC contribution. I request you to assign it to me.

[Sparkyyy45]

@Diwakar-odds pls go ahead

[Agnasmaria]

Could you please assign this issue