From 5f43b46e6523961f20407b51d211408556e47ac3 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 19 Aug 2026 22:01:11 +0000
Subject: [PATCH 1/2] Fix runtime panic on uppercase header

---
 .jules/sentinel.md                   | 4 ++++
 crates/gitlawb-node/src/api/repos.rs | 5 ++++-
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 00000000..b9d5cd53
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-05-24 - [CRITICAL] Fix uppercase header causing runtime panic
+**Vulnerability:** In `crates/gitlawb-node/src/api/repos.rs`, `"X-Total-Count"` was used as a string literal when inserting a header in Axum.
+**Learning:** Axum panics at runtime if a string literal containing uppercase letters is used for a header name due to implicit `IntoHeaderName` conversion, creating a DoS vulnerability.
+**Prevention:** Always use `axum::http::header::*` constants or lowercase string literals (e.g. `"x-total-count"`) for custom headers.
diff --git a/crates/gitlawb-node/src/api/repos.rs b/crates/gitlawb-node/src/api/repos.rs
index b09cb6da..f1d3bcf4 100644
--- a/crates/gitlawb-node/src/api/repos.rs
+++ b/crates/gitlawb-node/src/api/repos.rs
@@ -368,8 +368,11 @@ pub async fn list_repos(
         .map(|(r, stars)| to_response(&r, &state, stars))
         .collect();
     let mut response = Json(body).into_response();
+    // 🛡️ Sentinel: Fix DoS vulnerability
+    // Using uppercase letters in header names causes axum to panic during IntoHeaderName conversion.
+    // Changing to lowercase prevents runtime panic.
     response.headers_mut().insert(
-        "X-Total-Count",
+        "x-total-count",
         HeaderValue::from_str(&total.to_string()).unwrap_or(HeaderValue::from_static("0")),
     );
     Ok(response)

From ae8b0a7987ddd768801d304287a8e10a6dbd7e66 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 19 Aug 2026 22:24:58 +0000
Subject: [PATCH 2/2] Fix runtime panic on uppercase header and update h2 crate

---
 Cargo.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b7050bc6..c1f69d95 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3542,9 +3542,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.13"
+version = "0.4.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+checksum = "9f877e75f39e9827ec50a572dd592684ac28c029578726c85f1b2aa6ab807449"
 dependencies = [
  "atomic-waker",
  "bytes",