05/02/2026 updated code for security 6

app/routes/vault.py

@@ -1,5 +1,5 @@
 from flask import Blueprint, request, jsonify, g
-from app import db
+from app import db, limiter
 from app.models.vault_item import VaultItem, ItemType
 from app.models.audit_log import AuditLog
 from app.services.auth_service import require_jwt
@@ -15,6 +15,7 @@ def _client_ip():
 
 
 @vault_bp.route('', methods=['GET'])
+@limiter.limit('120 per minute')
 @require_jwt
 def list_items():
     items = VaultItem.query.filter_by(user_id=g.current_user_id).order_by(
@@ -24,6 +25,7 @@ def list_items():
 
 
 @vault_bp.route('', methods=['POST'])
+@limiter.limit('60 per minute')
 @require_jwt
 def create_item():
     data = request.get_json(silent=True) or {}
@@ -72,6 +74,7 @@ def create_item():
 
 
 @vault_bp.route('/<int:item_id>', methods=['GET'])
+@limiter.limit('120 per minute')
 @require_jwt
 def get_item(item_id):
     item = VaultItem.query.filter_by(id=item_id, user_id=g.current_user_id).first()
@@ -81,6 +84,7 @@ def get_item(item_id):
 
 
 @vault_bp.route('/<int:item_id>', methods=['PUT'])
+@limiter.limit('60 per minute')
 @require_jwt
 def update_item(item_id):
     item = VaultItem.query.filter_by(id=item_id, user_id=g.current_user_id).first()
@@ -129,6 +133,7 @@ def update_item(item_id):
 
 
 @vault_bp.route('/<int:item_id>', methods=['DELETE'])
+@limiter.limit('60 per minute')
 @require_jwt
 def delete_item(item_id):
     item = VaultItem.query.filter_by(id=item_id, user_id=g.current_user_id).first()
@@ -153,6 +158,7 @@ def delete_item(item_id):
 # ── Import / Export ───────────────────────────────────────────────────────────
 
 @vault_bp.route('/export', methods=['GET'])
+@limiter.limit('10 per minute')
 @require_jwt
 def export_items():
     """
@@ -178,6 +184,7 @@ def export_items():
 
 
 @vault_bp.route('/import', methods=['POST'])
+@limiter.limit('10 per minute')
 @require_jwt
 def import_items():
     """