- Add MAX_PAYLOAD_SIZE constant (10 MB) to prevent memory exhaustion - Validate store names against path traversal and special characters in routes layer (defense in depth) - Check Content-Length header and body size before processing - Return HTTP 413 for oversized payloads - Add comprehensive test coverage for validation edge cases Co-authored-by: Cursor Agent <cursoragent@cursor.com>