Fix Security Issues in GitHub API Error Handling and Enforce Refresh Cooldown

[Rakshak05]

Description

Fixes #7279

• Sanitized GitHub GraphQL error responses in lib/github.ts by logging raw error metadata server-side only and returning generic error messages to prevent leaking PAT identity, scopes, or rate limits to clients.
• Updated buildErrorResponse in app/api/streak/route.ts to return a standardized typed error JSON shape { error: "upstream_failure", code: "GITHUB_API_ERROR" } for 500 status upstream failures.
• Enforced a default 15-minute (900,000 ms) per-username cooldown on ?refresh=true cache-bypass requests in RefreshPolicy, configurable via REFRESH_COOLDOWN_MS.
• Updated SECURITY.md to explicitly document read:user scope requirements and fine-grained PAT recommendations for self-hosters.

Pillar

• 🎨 Pillar 1 — New Theme Design
• 📐 Pillar 2 — Geometric SVG Improvement
• 🕐 Pillar 3 — Timezone Logic Optimization
• 🛠️ Other (Bug fix, refactoring, docs)

Visual Preview

N/A (Backend security, error handling, and rate limiting optimization)

Checklist before requesting a review:

• I have read the CONTRIBUTING.md file.
• I have tested these changes locally (localhost:3000/api/streak?user=YOUR_USERNAME).
• I have run npm run format and npm run lint locally and resolved all errors (CI will fail otherwise).
• My commits follow the Conventional Commits format (e.g., feat(themes): ..., fix(calculate): ...).
• I have updated README.md if I added a new theme or URL parameter.
• I have started the repo.
• I have made sure that i have only one commit to merge in this PR.
• The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts).
• (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.

[vercel]

@Rakshak05 is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[retenta-bot]

This pull request addresses important security concerns by sanitizing error responses from the GitHub API and implementing a cooldown mechanism for refresh requests. This aligns with our previous decision to handle rate limits gracefully in the /api/streak endpoint, ensuring a better user experience. Thank you for your contributions, and I look forward to your updates!

[github-actions]

📦 Next.js Bundle Size Report (Gzipped Sizes)

✨ No significant bundle size changes detected.

📊 Summary of Totals

Category	PR Size	Base Size	Difference
Total JS	4998.89 KB	4998.89 KB	0 B
Total CSS	354.18 KB	354.18 KB	0 B