Fix HTML injection and harden server-side contact form handlers

[Copilot]

Both server/index.js and netlify/functions/contact.js interpolate user input directly into HTML email bodies, enabling HTML injection. The Express server also lacks input validation, rate limiting, body size limits, and leaks internal error details.

HTML injection in email templates

User-controlled fields (name, email, subject, message) were interpolated unsanitized into HTML:

// Before — attacker can inject arbitrary HTML
html: `<p><strong>Name:</strong> ${name}</p>`

// After — escaped before interpolation
const safeName = escapeHtml(name);
html: `<p><strong>Name:</strong> ${safeName}</p>`

Added escapeHtml() to both server/index.js and netlify/functions/contact.js.

Missing hardening in server/index.js

• Input validation — required field checks + email format regex (Netlify function had this; Express server did not)
• Rate limiting — in-memory per-IP rate limit (1 req/min), matching the Netlify function
• Body size limit — express.json({ limit: '1kb' })
• Error leaking — error.message was returned to client; replaced with generic message

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
harshit-kulkarni-portfolio	Ready	Preview, Comment	Feb 21, 2026 8:17am

[netlify]

✅ Deploy Preview for harshitkulkarnisportfolio ready!

Name	Link
🔨 Latest commit	1b0b500
🔍 Latest deploy log	https://app.netlify.com/projects/harshitkulkarnisportfolio/deploys/69996a0509f37a0008f3057e
😎 Deploy Preview	https://deploy-preview-2--harshitkulkarnisportfolio.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.