From 593be906a3547a541a89f8aafe3d0698c2b4b701 Mon Sep 17 00:00:00 2001
From: Adrian Llopart <67589468+AdrianLlopart@users.noreply.github.com>
Date: Wed, 8 Jul 2026 09:50:57 +0200
Subject: [PATCH 1/3] Apply suggested fix to api/contact.js from Copilot
 Autofix

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
---
 api/contact.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/api/contact.js b/api/contact.js
index adf035d..4214b9b 100644
--- a/api/contact.js
+++ b/api/contact.js
@@ -75,9 +75,9 @@ export default async function handler(req, res) {
   const name = clamp(body.name, 120);
   const email = clamp(body.email, 200);
   const message = clamp(body.message, 5000);
-  const honeypot = clamp(body.company, 100); // optional anti-spam trap
+  const companyField = clamp(body.company, 100); // honeypot (anti-spam trap) field
 
-  if (honeypot) return res.status(200).json({ ok: true }); // silently drop bots
+  if (companyField) return res.status(200).json({ ok: true }); // silently drop bots
   if (!name || !email || !message) {
     return res.status(400).json({ error: "Name, email and message are required." });
   }

From 8ed93aeed7cf2815bfbffaeae12d969b58ce89ce Mon Sep 17 00:00:00 2001
From: Adrian Llopart <67589468+AdrianLlopart@users.noreply.github.com>
Date: Wed, 8 Jul 2026 09:50:58 +0200
Subject: [PATCH 2/3] Apply suggested fix to api/contact.js from Copilot
 Autofix

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
---
 api/contact.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/contact.js b/api/contact.js
index 4214b9b..e71351c 100644
--- a/api/contact.js
+++ b/api/contact.js
@@ -34,7 +34,7 @@ function rateLimited(ip) {
   recent.push(now);
   hits.set(ip, recent);
   if (hits.size > 5000) hits.clear(); // bound memory on a long-lived instance
-  return recent.length > RATE_LIMIT.max;
+  return recent.length >= RATE_LIMIT.max;
 }
 
 function clamp(s, n) {

From 6a8f0661beca62f616328a86ff29e9c57904638d Mon Sep 17 00:00:00 2001
From: Adrian Llopart <67589468+AdrianLlopart@users.noreply.github.com>
Date: Wed, 8 Jul 2026 09:50:58 +0200
Subject: [PATCH 3/3] Apply suggested fix to api/contact.js from Copilot
 Autofix

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
---
 api/contact.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/contact.js b/api/contact.js
index e71351c..c84eed6 100644
--- a/api/contact.js
+++ b/api/contact.js
@@ -18,7 +18,7 @@ const ROUTES = {
   partner: "hello@openral.com",
 };
 
-const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const EMAIL_RE = /^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+@(?:(?!-)[A-Za-z0-9-]{1,63}(?<!-)\.)+[A-Za-z]{2,63}$/;
 
 // Best-effort, per-instance rate limit. Vercel functions are ephemeral and
 // horizontally scaled, so this is not a hard global cap — it just blunts a