POST /generate has no auth and rate limiting is optional — default deploy allows unbounded Replicate spend

Summary

app/generate/route.ts creates a paid Replicate prediction on every request with no auth. Rate limiting only runs if (ratelimit) (~line 17), and ratelimit is undefined whenever UPSTASH_REDIS_REST_URL/TOKEN aren't set (utils/redis.ts). The README and .example.env mark those as optional and the Vercel deploy button only prompts for REPLICATE_API_KEY, so the default production deploy has no throttling at all.

Impact

A loop against /generate runs up an arbitrary Replicate bill or exhausts the quota so real users see failures. Even with Redis configured, 5/day per IP is easy to bypass with rotating IPs.

Suggested fix

Either fail closed when the limiter is missing:

if (!ratelimit) return NextResponse.json({ error: "Rate limiter not configured" }, { status: 503 })

or put the route behind a session and key the limit on user id — plus a global daily cap (a second Ratelimit with a fixed identifier) as a circuit breaker so a leak is bounded.

Context

Found by an automated full-codebase review (VibeAudit, Claude Fable 5.1). I know roomGPT is a demo, but it's forked a lot, so flagging it. Full report: https://vibeaudit-amber.vercel.app/a/fx01roomgpt. Thanks for open-sourcing it.