Fix broken index.html path, invalid CSS, spurious child_process dep, and add rate limiting

[Copilot]

Three bugs in the Express app plus a missing security control on the upload endpoint.

Bug fixes

• Wrong static file path: GET / was serving __dirname + '/public/index.html' — no public/ directory exists. Fixed to __dirname + '/index.html'.
• Invalid CSS: #drop-area had border: 08px dashed (leading zero → invalid). Fixed to 8px.
• Spurious npm dependency: child_process is a Node.js built-in; removed it from package.json dependencies.

Security

• Added express-rate-limit with a general limit (100 req/15 min) across all routes and a stricter limit (10 req/15 min) scoped to POST /process-image, which hits the Gemini API and Google TTS on every request.

const processImageLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 10 });
app.post('/process-image', processImageLimiter, upload.single('file'), async (req, res) => { ... });

Project hygiene

• Added .gitignore covering node_modules/ and .env.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
brand-vision	Error		Mar 5, 2026 2:59pm