step 9.1: done

src/app.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const helmet = require('helmet');
+const rateLimit = require('express-rate-limit');
 const { createSessionMiddleware, requireAuth } = require('./middleware/session');
 const { registerLimiter, loginLimiter, routes: authRoutes } = require('./routes/auth');
 const { routes: characterRoutes } = require('./routes/character');
@@ -13,6 +14,13 @@ const { routes: leaderboardRoutes } = require('./routes/leaderboard');
 const { routes: heroProfileRoutes } = require('./routes/heroProfile');
 const { AppError } = require('./utils/errors');
 
+// General API rate limiter: 120 req/min per IP (SECURITY.md).
+const apiLimiter = rateLimit({
+  windowMs: 60 * 1000, // 1 minute
+  max: process.env.NODE_ENV === 'test' ? 1000 : 120,
+  message: { ok: false, error: { code: 'RATE_LIMITED', message: 'Too many requests. Try again later.' } },
+});
+
 function createApp() {
   const app = express();
 
@@ -44,6 +52,9 @@ function createApp() {
   app.post('/api/auth/logout', requireAuth, authRoutes.postLogout);
   app.get('/api/auth/me', requireAuth, authRoutes.getMe);
 
+  // General API rate limiter (applies to all non-auth routes below)
+  app.use('/api', apiLimiter);
+
   // Character routes (require session)
   app.post('/api/character', requireAuth, characterRoutes.postCharacter);
   app.get('/api/character', requireAuth, characterRoutes.getCharacter);