vetkit.data-access.unpaginated-list-endpoint.model
A GET endpoint returns the result of a list query that has no row limit. Every request loads and serialises the whole collection (or everything matching the filter), so response time, memory use and database load grow without bound as the data grows, and one request can be enough to slow the service down.
Last updated:
Suite: Production readiness
javascript, typescript
A GET endpoint returns the result of a list query that has no row limit. Every request loads and serialises the whole collection (or everything matching the filter), so response time, memory use and database load grow without bound as the data grows, and one request can be enough to slow the service down.
Category: DATABASE · Engine rule severity: INFO
How to fix it
Paginate the endpoint: accept a page size (with a server-side maximum) and a cursor or page parameter, and pass them to the query (.limit() / .skip() or a range on an indexed field in Mongoose, limit / offset in Sequelize). Return the next cursor so clients can request more.
References
Source: packages/engine/rules/data-access/javascript.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.