Pagination limits

Verifies

Every list endpoint paginates with a server-side maximum page size; no route can return a whole collection. No AI engine is involved: the verdict is reproducible from the source alone.

Inputs

Non-test code files of the checkout (JavaScript, TypeScript, Python, PHP), analysed statically with the platform kit: tokens, function units, calls, imports and route registrations of Next (app and pages), Express, Fastify, Koa, Hono, Nest, Lambda, Django (views and urls.py), Flask, FastAPI and Laravel. A list handler is a GET, POST or ANY route whose handler — or a function it calls within 2 module hops — reads a collection from a data store: findMany, findAll, getAll, listAll, fetchAll, scan, toArray, aggregate anywhere; find, list, all, get, query, filter, select, search, where, stream only on a DAO, repository, model, db, ORM or collection receiver and not with a single id; Django objects.all()/filter(), Laravel ::all()/::get()/->get(), SELECT … FROM, Prisma/Mongo find with an empty filter, SQLAlchemy session.query. Single-record reads (findOne, findById, findUnique, first, get(id), get_object_or_404, count) are not listings; a call into an exchange or third-party API is not a collection read. Pagination vocabulary (limit, take, per_page, page_size, paginate, cursor, offset, skip, a literal slice, .limit()/.take()) and clamps (Math.min, min(), clamp(), a comparison against a MAX constant, a validator maximum, paginate(n), .limit(n)) are searched in the handler, in the arguments of the read and in the functions it calls within 2 module hops; a page size from the request is req.query/request.args/request.GET/query_params/searchParams.get/$request->input of limit, per_page, page_size, take, count, size or top. A framework-wide page size is DRF PAGE_SIZE/DEFAULT_PAGINATION_CLASS or a Laravel $perPage. Paths listed in excludes are never analysed. Nothing of the checkout is executed.

Decision rule

Not applicable when no route reads a collection. FAIL (HIGH, unbounded-list) when a list handler reads a whole collection and no pagination vocabulary is found in the handler, in the arguments of the read or in its callees within 2 module hops, and the checkout declares no framework-wide page size. A page size taken from the request without a clamp in the handler, the read or its callees is MEDIUM (client-controlled-page-size; blocks only in Extended suites). PASS when every list handler paginates (the summary names each handler, the read and where the page size is bounded). Not judged by this check (declared): the size of the table behind a read (a reference table reads like a customer table), limits enforced by a data layer outside the analysed files (a DAO of a private package) and the value of the maximum (a cap of 10000 passes).

Type

deterministic

1.1.1: a callee whose root is a name that `Object.prototype` also carries (`build().toString()` tokenizes to the bare callee `toString`; also `constructor`, `valueOf`, `hasOwnProperty`) was looked up in the plain object that holds the imported names, so it resolved to the INHERITED FUNCTION instead of to nothing and the whole check died with "name.includes is not a function". Only a real binding counts now, and the name of a unit is always read as a string. Found on a 1 319-file checkout (2fa-available and session-expiry-rotation, 2026-09-24); the same line was in the 15 scripts that walk the call graph, so all fifteen ship the fix. (1.1.0: deterministic: the rule runs over the static analysis kit (tokens, function units, calls, imports, routes) with no AI engine; exact decisionRule and languages published; not-applicable with the reason when the checkout gives nothing to evaluate. A list handler reads a collection in its body or through a callee whose result reaches the response (data-layer receivers only; single-record reads and third-party API calls excluded); pagination or clamp is searched in the handler, the read arguments and the callees; DRF PAGE_SIZE and Laravel $perPage count as a framework page size. Not judged: table size, external data layers. (1.0.2: never analyses temporary files (*.tmp.*; spec.excludes follows AUDITOR_ANALYSIS_EXCLUDES). (1.0.1: never analyses test, spec, fixture and mock paths nor the auditor's own scripts (spec.excludes = AUDITOR_ANALYSIS_EXCLUDES); a fixture-looking secret (sk_test_, example, dummy) in real code is LOW, informative; every model call stays under the engine prompt cap (spec.promptMaxChars = AUDITOR_AI_PROMPT_MAX_CHARS): assess mode sends the candidate set in parts and aggregates the verdicts (a HIGH in any part is a FAIL, an unsatisfied part is a FAIL).)))

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.