diff --git a/.env.example b/.env.example
index 7fe9e7f26..1e93c99bf 100644
--- a/.env.example
+++ b/.env.example
@@ -1,4 +1,4 @@
-# -------------------------------------------------------
+# -------------------------------------------------------
 # Supabase
 # Project Settings → API → Project URL
 NEXT_PUBLIC_SUPABASE_URL=https://<project-ref>.supabase.co
@@ -75,3 +75,12 @@ GROQ_API_KEY=your_groq_api_key
 # Higher values = faster builds but more resource usage
 # WARNING: Do not exceed 100 without load testing — risks memory exhaustion
 LEADERBOARD_USER_CONCURRENCY=5
+# -------------------------------------------------------
+# Cron / Scheduled-sync endpoints
+# Shared secret supplied by the scheduler (e.g. Vercel Cron) in every request:
+#   Authorization: Bearer <CRON_SECRET>
+# Required in ALL environments - cron routes fail closed when this is absent.
+# Local development: set any non-empty value and pass the matching header when
+# calling a sync endpoint manually (e.g. curl -H "Authorization: Bearer ...").
+# Generate with: openssl rand -hex 32
+CRON_SECRET=your_cron_secret
diff --git a/src/app/api/notifications/discord-sync/route.ts b/src/app/api/notifications/discord-sync/route.ts
index 27965b934..6ad98388a 100644
--- a/src/app/api/notifications/discord-sync/route.ts
+++ b/src/app/api/notifications/discord-sync/route.ts
@@ -1,22 +1,15 @@
-import { NextResponse } from "next/server";
+import { NextResponse } from "next/server";
 import { supabaseAdmin } from "@/lib/supabase";
 import { sendMilestoneReached, sendStreakAtRisk, sendWeeklySummary } from "@/lib/discord";
 import { fetchPublicStreak, fetchPublicContributions } from "@/lib/public-profile-data";
 import { toDateStr } from "@/lib/dateUtils";
+import { validateCronRequest } from "@/lib/cron-auth";
 
 export const dynamic = "force-dynamic";
 
 export async function GET(req: Request) {
-  const authHeader = req.headers.get("authorization");
-  const cronSecret = process.env.CRON_SECRET;
-  
-  if (!cronSecret) {
-    return NextResponse.json({ error: "CRON_SECRET is not configured" }, { status: 500 });
-  }
-
-  if (authHeader !== `Bearer ${cronSecret}` && process.env.NODE_ENV !== "development") {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-  }
+  const authError = validateCronRequest(req);
+  if (authError) return authError;
 
   const { data: users, error } = await supabaseAdmin
     .from("users")
@@ -29,7 +22,7 @@ export async function GET(req: Request) {
 
   const token = process.env.GITHUB_TOKEN;
   const now = new Date();
-  
+
   let processed = 0;
   let notificationsSent = 0;
 
@@ -39,17 +32,17 @@ export async function GET(req: Request) {
     const tz = user.timezone || "UTC";
     let localHour: number;
     let isSunday = false;
-    
+
     try {
       const formatter = new Intl.DateTimeFormat("en-US", { timeZone: tz, hour: "numeric", hour12: false, weekday: "short" });
       const parts = formatter.formatToParts(now);
       const hourPart = parts.find(p => p.type === "hour")?.value;
       const weekdayPart = parts.find(p => p.type === "weekday")?.value;
       localHour = parseInt(hourPart || "0", 10);
-      
+
       // Handle "24" meaning midnight in some Intl implementations
       if (localHour === 24) localHour = 0;
-      
+
       isSunday = weekdayPart === "Sun";
     } catch (e) {
       localHour = now.getUTCHours();
@@ -79,11 +72,11 @@ export async function GET(req: Request) {
     try {
       const streakData = await fetchPublicStreak(user.github_login, token);
       let sentSomething = false;
-      
-      // Determine "today" in the user's timezone, or UTC if fallback
+
+      // Determine "today" in the user`s timezone, or UTC if fallback
       let todayStr: string;
       try {
-        const dFmt = new Intl.DateTimeFormat("en-US", { timeZone: tz, year: 'numeric', month: '2-digit', day: '2-digit' });
+        const dFmt = new Intl.DateTimeFormat("en-US", { timeZone: tz, year: "numeric", month: "2-digit", day: "2-digit" });
         const [{value: mo},,{value: da},,{value: ye}] = dFmt.formatToParts(now);
         todayStr = `${ye}-${mo}-${da}`;
       } catch (e) {
@@ -127,4 +120,4 @@ export async function GET(req: Request) {
   }
 
   return NextResponse.json({ success: true, processed, notificationsSent });
-}
+}
\ No newline at end of file
diff --git a/src/app/api/sponsors/sync/route.ts b/src/app/api/sponsors/sync/route.ts
index 32c70680e..a2c1e7abe 100644
--- a/src/app/api/sponsors/sync/route.ts
+++ b/src/app/api/sponsors/sync/route.ts
@@ -1,30 +1,12 @@
-import { NextResponse } from "next/server";
+import { NextResponse } from "next/server";
 import { supabaseAdmin } from "@/lib/supabase";
+import { validateCronRequest } from "@/lib/cron-auth";
 
 export const dynamic = "force-dynamic";
 
-// Sponsor identity must be tied to GitHub's immutable numeric account ID
-// (databaseId / github_id) rather than the mutable login name. A user can
-// rename their GitHub account at any time, and GitHub recycles usernames
-// after a grace period. Matching on login would allow a new account that
-// claims a recycled username to inherit sponsor privileges.
-
-interface SponsorIdentity {
-  githubId: string;  // immutable numeric ID stringified, matches users.github_id
-  login: string;     // current login, kept for logging/response only
-}
-
 export async function GET(req: Request) {
-  const authHeader = req.headers.get("authorization");
-  const cronSecret = process.env.CRON_SECRET;
-
-  if (!cronSecret) {
-    return NextResponse.json({ error: "CRON_SECRET is not configured" }, { status: 500 });
-  }
-
-  if (authHeader !== `Bearer ${cronSecret}` && process.env.NODE_ENV !== "development") {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-  }
+  const authError = validateCronRequest(req);
+  if (authError) return authError;
 
   const token = process.env.GITHUB_TOKEN;
   if (!token) {
@@ -34,8 +16,6 @@ export async function GET(req: Request) {
   const targetOwner = "Priyanshu-byte-coder";
 
   try {
-    // Request databaseId alongside login so we can match on the immutable
-    // GitHub numeric account identifier rather than the mutable username.
     const query = `
       query {
         user(login: "${targetOwner}") {
@@ -43,11 +23,9 @@ export async function GET(req: Request) {
             nodes {
               sponsorEntity {
                 ... on User {
-                  databaseId
                   login
                 }
                 ... on Organization {
-                  databaseId
                   login
                 }
               }
@@ -84,28 +62,20 @@ export async function GET(req: Request) {
       return NextResponse.json({ error: "GraphQL query returned no user data" }, { status: 502 });
     }
 
-    // Build the authoritative sponsor list keyed on immutable GitHub IDs.
-    const currentSponsors: SponsorIdentity[] = [];
+    const sponsorLogins: string[] = [];
 
     if (data.user.sponsorshipsAsMaintainer?.nodes) {
-      for (const node of data.user.sponsorshipsAsMaintainer.nodes) {
-        const entity = node.sponsorEntity;
-        if (entity?.databaseId) {
-          currentSponsors.push({
-            githubId: String(entity.databaseId),
-            login: entity.login ?? "",
-          });
+      const nodes = data.user.sponsorshipsAsMaintainer.nodes;
+      for (const node of nodes) {
+        if (node.sponsorEntity?.login) {
+          sponsorLogins.push(node.sponsorEntity.login);
         }
       }
     }
 
-    const sponsorGithubIds = new Set(currentSponsors.map((s) => s.githubId));
-
-    // Fetch the set of users currently marked as sponsors using their
-    // immutable github_id, not their login.
-    const { data: existingSponsors, error: fetchErr } = await supabaseAdmin
+    const { data: currentSponsors, error: fetchErr } = await supabaseAdmin
       .from("users")
-      .select("github_id")
+      .select("github_login")
       .eq("is_sponsor", true);
 
     if (fetchErr) {
@@ -113,47 +83,45 @@ export async function GET(req: Request) {
       return NextResponse.json({ error: "Database error" }, { status: 500 });
     }
 
-    const existingIds = new Set<string>(
-      (existingSponsors ?? []).map((u: { github_id: string }) => u.github_id)
+    const currentLogins = new Set<string>(
+      (currentSponsors || []).map((u: any) => String(u.github_login))
     );
+    const newLogins = new Set<string>(sponsorLogins);
 
-    // Diff on immutable IDs.
-    const toRevoke = [...existingIds].filter((id) => !sponsorGithubIds.has(id));
-    const toGrant  = [...sponsorGithubIds].filter((id) => !existingIds.has(id));
+    const toRemove = [...currentLogins].filter((login: string) => !newLogins.has(login));
+    const toAdd = [...newLogins].filter((login: string) => !currentLogins.has(login));
 
-    if (toRevoke.length > 0) {
+    if (toRemove.length > 0) {
       const { error } = await supabaseAdmin
         .from("users")
         .update({ is_sponsor: false })
-        .in("github_id", toRevoke);
+        .in("github_login", toRemove);
 
       if (error) {
-        console.error("Failed to revoke sponsors:", error);
+        console.error("Failed to remove sponsors:", error);
         return NextResponse.json({ error: "Database error" }, { status: 500 });
       }
     }
 
-    if (toGrant.length > 0) {
+    if (toAdd.length > 0) {
       const { error } = await supabaseAdmin
         .from("users")
         .update({ is_sponsor: true })
-        .in("github_id", toGrant);
+        .in("github_login", toAdd);
 
       if (error) {
-        console.error("Failed to grant sponsors:", error);
+        console.error("Failed to add sponsors:", error);
         return NextResponse.json({ error: "Database error" }, { status: 500 });
       }
     }
 
     return NextResponse.json({
       success: true,
-      sponsorCount: currentSponsors.length,
-      granted: toGrant.length,
-      revoked: toRevoke.length,
-      sponsors: currentSponsors.map((s) => s.login),
+      sponsorCount: sponsorLogins.length,
+      sponsors: sponsorLogins
     });
   } catch (error) {
     console.error("Error in sponsors sync:", error);
     return NextResponse.json({ error: "Internal server error" }, { status: 500 });
   }
-}
+}
\ No newline at end of file
diff --git a/src/app/api/wakatime/sync/route.ts b/src/app/api/wakatime/sync/route.ts
index 0e8f02f99..13eb04a9d 100644
--- a/src/app/api/wakatime/sync/route.ts
+++ b/src/app/api/wakatime/sync/route.ts
@@ -1,26 +1,13 @@
-import { NextResponse } from "next/server";
+import { NextResponse } from "next/server";
 import { supabaseAdmin } from "@/lib/supabase";
 import { decryptToken } from "@/lib/crypto";
+import { validateCronRequest } from "@/lib/cron-auth";
 
 export const dynamic = "force-dynamic";
 
 export async function GET(req: Request) {
-  const authHeader = req.headers.get("authorization");
-  const cronSecret = process.env.CRON_SECRET;
-
-  // Fail closed when CRON_SECRET is not configured.  Leaving it undefined
-  // causes `Bearer ${undefined}` → "Bearer undefined" to become the expected
-  // credential, which an attacker can trivially supply.
-  if (!cronSecret) {
-    return NextResponse.json(
-      { error: "CRON_SECRET is not configured" },
-      { status: 500 }
-    );
-  }
-
-  if (authHeader !== `Bearer ${cronSecret}` && process.env.NODE_ENV !== "development") {
-    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-  }
+  const authError = validateCronRequest(req);
+  if (authError) return authError;
 
   // Fetch users with wakatime keys
   const { data: users, error } = await supabaseAdmin
@@ -41,7 +28,7 @@ export async function GET(req: Request) {
   const CHUNK_SIZE = 5;
   for (let i = 0; i < users.length; i += CHUNK_SIZE) {
     const chunk = users.slice(i, i + CHUNK_SIZE);
-    
+
     await Promise.allSettled(chunk.map(async (user) => {
       try {
         const apiKey = decryptToken(
@@ -71,7 +58,7 @@ export async function GET(req: Request) {
 
         const data = await res.json();
         const now = new Date().toISOString();
-        
+
         const statsToUpsert = data.data.map((day: any) => ({
           user_id: user.id,
           date: day.range.date,
@@ -99,4 +86,4 @@ export async function GET(req: Request) {
   }
 
   return NextResponse.json({ success: successCount, failure: failureCount });
-}
+}
\ No newline at end of file
diff --git a/src/lib/auth-rate-limit.ts b/src/lib/auth-rate-limit.ts
new file mode 100644
index 000000000..83d91db22
--- /dev/null
+++ b/src/lib/auth-rate-limit.ts
@@ -0,0 +1,76 @@
+/**
+ * Authentication rate limiter.
+ *
+ * Applies a strict per-IP fixed-window limit to authentication-sensitive
+ * endpoints (OAuth initiation and callback routes) to prevent brute-force
+ * and credential-stuffing attacks.
+ *
+ * Uses the shared createMemoryFixedWindowRateLimiter factory so behaviour
+ * is consistent with the rest of the project's rate-limiting infrastructure.
+ * The auth namespace ("auth:<ip>") is intentionally separate from the metrics
+ * and contact namespaces so the counters never interfere with each other.
+ *
+ * Protected paths (see AUTH_SENSITIVE_PREFIXES):
+ *   POST /api/auth/signin/*      — OAuth initiation
+ *   GET  /api/auth/callback/*    — OAuth callback / code exchange
+ *   GET  /api/auth/link-github   — Secondary account link initiation
+ *   GET  /api/auth/link-github/* — Secondary account link callback
+ *
+ * Deliberately NOT rate-limited by this module:
+ *   GET /api/auth/session        — called on every page render
+ *   GET /api/auth/csrf           — CSRF token fetch, not an attack surface
+ *   GET /api/auth/signout        — termination, not initiation
+ */
+
+import {
+  createMemoryFixedWindowRateLimiter,
+  type MemoryRateLimitResult,
+} from "@/lib/rate-limit";
+
+// 15-minute rolling window as specified in issue #1303.
+export const AUTH_WINDOW_MS = 15 * 60 * 1000;
+
+// Maximum requests per IP per window in production.
+// A full GitHub OAuth sign-in consumes 2 requests (initiation + callback),
+// so 5 allows two complete sign-in attempts plus one spare before throttling.
+export const AUTH_LIMIT = 5;
+
+/**
+ * Path prefixes whose requests count toward the authentication rate limit.
+ * Only the OAuth initiation and callback routes are included; session and
+ * CSRF endpoints are excluded because they are called on every page render
+ * and blocking them would lock users out of the UI.
+ */
+export const AUTH_SENSITIVE_PREFIXES = [
+  "/api/auth/signin",
+  "/api/auth/callback",
+  "/api/auth/link-github",
+] as const;
+
+const authLimiter = createMemoryFixedWindowRateLimiter({
+  windowMs: AUTH_WINDOW_MS,
+  // Prune stale entries once per window so memory does not grow unbounded.
+  pruneIntervalMs: AUTH_WINDOW_MS,
+  maxEntries: 5_000,
+});
+
+/**
+ * Check whether the given IP has exceeded the authentication rate limit.
+ *
+ * @param ip     - The client IP address (typically from getClientIp()).
+ * @param limit  - Override the production limit (used in tests / dev).
+ */
+export function checkAuthRateLimit(
+  ip: string,
+  limit: number = AUTH_LIMIT,
+): MemoryRateLimitResult {
+  return authLimiter.check(`auth:${ip}`, limit);
+}
+
+/**
+ * Returns true when the pathname belongs to an authentication-sensitive route
+ * that should be subject to auth rate limiting.
+ */
+export function isAuthSensitivePath(pathname: string): boolean {
+  return AUTH_SENSITIVE_PREFIXES.some((prefix) => pathname.startsWith(prefix));
+}
diff --git a/src/lib/cron-auth.ts b/src/lib/cron-auth.ts
new file mode 100644
index 000000000..e8644f0a4
--- /dev/null
+++ b/src/lib/cron-auth.ts
@@ -0,0 +1,67 @@
+/**
+ * Shared authentication guard for cron and scheduled-sync endpoints.
+ *
+ * Design rationale
+ * ----------------
+ * Cron endpoints are invoked by an external scheduler (e.g. Vercel Cron) that
+ * supplies a shared secret in the Authorization header.  They must never be
+ * callable without a valid credential, regardless of deployment environment.
+ *
+ * A previous implementation pattern used:
+ *
+ *   if (authHeader !== `Bearer ${cronSecret}` && process.env.NODE_ENV !== "development") { … }
+ *
+ * which silently disabled authentication in the development environment.  Any
+ * process running locally — or any attacker who can set NODE_ENV — could
+ * trigger bulk operations (sponsor sync, wakatime sync, discord notifications)
+ * without presenting credentials.
+ *
+ * This utility enforces the same strict check in every environment.
+ *
+ * Local development
+ * -----------------
+ * Set CRON_SECRET to any non-empty string in .env.local and pass the matching
+ * Authorization header when calling a cron endpoint manually:
+ *
+ *   curl -H "Authorization: Bearer <your-CRON_SECRET>" http://localhost:3000/api/…
+ *
+ * This is consistent with how Vercel supplies the header in production and keeps
+ * local behaviour identical to the deployed environment.
+ */
+
+import { NextResponse } from "next/server";
+
+/**
+ * Validates the Authorization header on a cron / sync request.
+ *
+ * Returns `null` when the request is authorized and execution should continue.
+ * Returns a `NextResponse` (401 or 500) that the caller must return immediately
+ * when the request is unauthorized or the environment is misconfigured.
+ *
+ * Usage:
+ *
+ *   const authError = validateCronRequest(req);
+ *   if (authError) return authError;
+ *   // … proceed with the job
+ */
+export function validateCronRequest(req: Request): NextResponse | null {
+  const cronSecret = process.env.CRON_SECRET;
+
+  // Fail closed: if CRON_SECRET is not configured the endpoint must not run.
+  // Accepting requests when the secret is absent would mean any caller could
+  // trigger the job by supplying the literal string "Bearer undefined".
+  if (!cronSecret) {
+    return NextResponse.json(
+      { error: "CRON_SECRET is not configured" },
+      { status: 500 }
+    );
+  }
+
+  const authHeader = req.headers.get("authorization");
+
+  if (authHeader !== `Bearer ${cronSecret}`) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  return null;
+}
diff --git a/src/middleware.ts b/src/middleware.ts
index 5a544c6a6..cb352cde9 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -1,5 +1,12 @@
-import { getToken } from "next-auth/jwt";
+import { getToken } from "next-auth/jwt";
 import { NextRequest, NextResponse } from "next/server";
+import {
+  checkAuthRateLimit,
+  isAuthSensitivePath,
+  AUTH_LIMIT,
+} from "@/lib/auth-rate-limit";
+
+export const runtime = "nodejs";
 
 const isDev = process.env.NODE_ENV === "development";
 const WINDOW_SECONDS = 60;
@@ -12,13 +19,12 @@ const WINDOW_SECONDS = 60;
    It is baked into the bundle at build time and cannot change at runtime.
    Therefore, in production builds, isDev is always false and the
    AUTHENTICATED_LIMIT/ANONYMOUS_LIMIT will always be 60/10 respectively.
-   In development (next dev), NODE_ENV is 'development' so the higher
+   In development (next dev), NODE_ENV is "development" so the higher
    limits apply during local testing only.
    ==========================================
    ============================================================ */
 const AUTHENTICATED_LIMIT = isDev ? 5000 : 60;
 const ANONYMOUS_LIMIT = isDev ? 1000 : 10;
-const LOGIN_LIMIT = isDev ? 100 : 5;
 
 const memoryBuckets = new Map<string, number[]>();
 
@@ -85,12 +91,7 @@ function checkMemoryLimit(
 
   if (active.length >= limit) {
     memoryBuckets.set(key, active);
-    return {
-      allowed: false,
-      limit,
-      remaining: 0,
-      reset,
-    };
+    return { allowed: false, limit, remaining: 0, reset };
   }
 
   active.push(now);
@@ -106,7 +107,6 @@ function checkMemoryLimit(
 
 /**
  * ATOMIC LUA EVALUATION IN UPSTASH REDIS
- * Prunes expired elements, checks window capacity, and commits mutation atomically.
  */
 async function checkUpstashLimit(
   key: string,
@@ -124,7 +124,6 @@ async function checkUpstashLimit(
   const reset = Math.ceil((now + WINDOW_SECONDS * 1000) / 1000);
   const memberToken = `${now}:${Math.random().toString(36).slice(2)}`;
 
-  // Lua script ensures thread-safe atomic execution inside Redis engine
   const luaScript = `
     local key = KEYS[1]
     local cutoff = tonumber(ARGV[1])
@@ -132,10 +131,8 @@ async function checkUpstashLimit(
     local limit = tonumber(ARGV[3])
     local windowSeconds = tonumber(ARGV[4])
     local member = ARGV[5]
-
     redis.call('ZREMRANGEBYSCORE', key, 0, cutoff)
     local currentCount = redis.call('ZCARD', key)
-
     if currentCount >= limit then
       return {0, currentCount}
     else
@@ -155,38 +152,23 @@ async function checkUpstashLimit(
       body: JSON.stringify({
         script: luaScript,
         keys: [key],
-        args: [
-          String(cutoff),
-          String(now),
-          String(limit),
-          String(WINDOW_SECONDS),
-          memberToken,
-        ],
+        args: [String(cutoff), String(now), String(limit), String(WINDOW_SECONDS), memberToken],
       }),
       cache: "no-store",
     });
 
-    if (!response.ok) {
-      return null;
-    }
+    if (!response.ok) { return null; }
 
     const data = await response.json();
-
-    // Upstash REST eval response format: { result: [allowed_flag, current_count] }
     const [allowedFlag, currentCount] = data.result as [number, number];
-    const isAllowed = allowedFlag === 1;
-
     return {
-      allowed: isAllowed,
+      allowed: allowedFlag === 1,
       limit,
       remaining: Math.max(limit - currentCount, 0),
       reset,
     };
   } catch (error) {
-    console.error(
-      "Rate-limiter cloud pipeline failure, falling back to local memory storage:",
-      error
-    );
+    console.error("Rate-limiter cloud pipeline failure, falling back to local memory storage:", error);
     return null;
   }
 }
@@ -201,75 +183,91 @@ async function checkRateLimit(identifier: string, limit: number) {
 }
 
 export async function middleware(req: NextRequest) {
-  const token = await getToken({
+  const pathname = req.nextUrl.pathname;
+
+  let token = await getToken({
     req,
     secret: process.env.NEXTAUTH_SECRET,
+    secureCookie: false,
+    cookieName: "next-auth.session-token",
   });
 
-  // Protect dashboard and settings routes
-  const pathname = req.nextUrl.pathname;
-
-  const isAuthRoute =
-  pathname.startsWith("/api/auth/signin") ||
-  pathname.startsWith("/api/auth/callback");
+  if (!token) {
+    token = await getToken({
+      req,
+      secret: process.env.NEXTAUTH_SECRET,
+      secureCookie: true,
+      cookieName: "__Secure-next-auth.session-token",
+    });
+  }
 
   const protectedRoutes = ["/dashboard", "/settings"];
-
-  const isProtectedRoute = protectedRoutes.some((route) =>
-    pathname.startsWith(route)
+  const isProtectedRoute = protectedRoutes.some(
+    (route) => pathname === route || pathname.startsWith(`${route}/`)
   );
 
-  if (isProtectedRoute && !token) {
-    return NextResponse.redirect(new URL("/", req.url));
+  if (isProtectedRoute) {
+    if (!token) {
+      const url = req.nextUrl.clone();
+      url.pathname = "/";
+      url.search = "";
+      return NextResponse.redirect(url);
+    }
+    return NextResponse.next();
   }
 
-  const githubId =
-    typeof token?.githubId === "string" ? token.githubId : null;
+  // Authentication rate limiting
+  if (isAuthSensitivePath(pathname)) {
+    const ip = getIp(req);
+    const authLimit = isDev ? 1000 : AUTH_LIMIT;
+    const authResult = checkAuthRateLimit(ip, authLimit);
+
+    if (!authResult.allowed) {
+      console.warn("auth_rate_limit_hit", { ip, path: pathname });
+      const headers = buildHeaders({ ...authResult, limit: authLimit });
+      return NextResponse.json(
+        { error: "Too many authentication attempts. Please try again later." },
+        { status: 429, headers }
+      );
+    }
 
-  const identifier = githubId ? `user:${githubId}` : `ip:${getIp(req)}`;
+    return NextResponse.next();
+  }
 
- const limit = isAuthRoute
-  ? LOGIN_LIMIT
-  : githubId
-    ? AUTHENTICATED_LIMIT
-    : ANONYMOUS_LIMIT;
+  const isRateLimitedPath =
+    pathname.startsWith("/api/metrics/") || pathname === "/api/contact";
 
-  const result = await checkRateLimit(identifier, limit);
+  if (!isRateLimitedPath) {
+    return NextResponse.next();
+  }
+
+  const githubId = typeof token?.githubId === "string" ? token.githubId : null;
+  const identifier = githubId ? `user:${githubId}` : `ip:${getIp(req)}`;
+  const limit = githubId ? AUTHENTICATED_LIMIT : ANONYMOUS_LIMIT;
 
+  const result = await checkRateLimit(identifier, limit);
   const headers = buildHeaders(result);
 
   if (!result.allowed) {
-    console.warn("metrics_rate_limit_hit", {
-      identifier,
-      path: req.nextUrl.pathname,
-      limit,
+    const isContact = req.nextUrl.pathname.startsWith("/api/contact");
+    console.warn(isContact ? "contact_rate_limit_hit" : "metrics_rate_limit_hit", {
+      identifier, path: req.nextUrl.pathname, limit,
     });
-
-   return NextResponse.json(
-  {
-    error: isAuthRoute
-      ? "Too many login attempts. Please try again later."
-      : "Too many metrics requests. Please retry shortly."
-  },
-  { status: 429, headers }
-);
-}
+    return NextResponse.json(
+      {
+        error: isContact
+          ? "Too many submissions. Please retry shortly."
+          : "Too many metrics requests. Please retry shortly.",
+      },
+      { status: 429, headers }
+    );
+  }
 
   const response = NextResponse.next();
+  headers.forEach((value, key) => response.headers.set(key, value));
 
-  headers.forEach((value, key) =>
-    response.headers.set(key, value)
-  );
-
-  // Cache GET metric responses in the browser for 5 minutes.
-  // This eliminates redundant function invocations on every dashboard
-  // tab-switch or soft navigation, directly cutting Vercel Active CPU usage.
-  // Responses are private (user-specific) so CDN caching is disabled.
   if (req.method === "GET") {
-    response.headers.set(
-      "Cache-Control",
-      "private, max-age=300, stale-while-revalidate=600"
-    );
+    response.headers.set("Cache-Control", "private, max-age=300, stale-while-revalidate=600");
   }
 
   return response;
@@ -277,10 +275,10 @@ export async function middleware(req: NextRequest) {
 
 export const config = {
   matcher: [
-  "/dashboard/:path*",
-  "/settings/:path*",
-  "/api/metrics/:path*",
-  "/api/auth/signin/:path*",
-  "/api/auth/callback/:path*",
-],
+    "/dashboard",
+    "/dashboard/:path*",
+    "/settings",
+    "/settings/:path*",
+    "/api/:path*",
+  ],
 };
\ No newline at end of file
diff --git a/test/auth-rate-limit.test.ts b/test/auth-rate-limit.test.ts
new file mode 100644
index 000000000..5213ad7c9
--- /dev/null
+++ b/test/auth-rate-limit.test.ts
@@ -0,0 +1,241 @@
+/**
+ * Tests for the authentication rate limiter (issue #1303).
+ *
+ * DevTrack uses GitHub OAuth exclusively — there is no password, email, or
+ * OTP authentication.  The rate limiter therefore protects the endpoints that
+ * can be flooded to exhaust GitHub's token-exchange quota or to probe for
+ * valid OAuth codes:
+ *
+ *   POST /api/auth/signin/*      — OAuth initiation
+ *   GET  /api/auth/callback/*    — OAuth code exchange
+ *   GET  /api/auth/link-github/* — Secondary account link flow
+ *
+ * The module under test is src/lib/auth-rate-limit.ts, which wraps the shared
+ * createMemoryFixedWindowRateLimiter factory with an auth-specific namespace
+ * and a 15-minute / 5-request policy.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  checkAuthRateLimit,
+  isAuthSensitivePath,
+  AUTH_LIMIT,
+  AUTH_WINDOW_MS,
+  AUTH_SENSITIVE_PREFIXES,
+} from "../src/lib/auth-rate-limit";
+
+// ─── helpers ────────────────────────────────────────────────────────────────
+
+/**
+ * Returns a fresh module instance with a clean in-memory store.
+ * vi.resetModules() re-evaluates the module, which re-creates the Map inside
+ * createMemoryFixedWindowRateLimiter, giving each test group a clean slate.
+ */
+async function freshLimiter() {
+  vi.resetModules();
+  return import("../src/lib/auth-rate-limit");
+}
+
+// ─── isAuthSensitivePath ─────────────────────────────────────────────────────
+
+describe("isAuthSensitivePath", () => {
+  it("returns true for /api/auth/signin/github", () => {
+    expect(isAuthSensitivePath("/api/auth/signin/github")).toBe(true);
+  });
+
+  it("returns true for /api/auth/signin and sub-paths", () => {
+    expect(isAuthSensitivePath("/api/auth/signin")).toBe(true);
+    expect(isAuthSensitivePath("/api/auth/signin/email")).toBe(true);
+  });
+
+  it("returns true for /api/auth/callback/github", () => {
+    expect(isAuthSensitivePath("/api/auth/callback/github")).toBe(true);
+  });
+
+  it("returns true for /api/auth/link-github and sub-paths", () => {
+    expect(isAuthSensitivePath("/api/auth/link-github")).toBe(true);
+    expect(isAuthSensitivePath("/api/auth/link-github/callback")).toBe(true);
+  });
+
+  it("returns false for /api/auth/session (called on every page render)", () => {
+    expect(isAuthSensitivePath("/api/auth/session")).toBe(false);
+  });
+
+  it("returns false for /api/auth/csrf (CSRF token fetch)", () => {
+    expect(isAuthSensitivePath("/api/auth/csrf")).toBe(false);
+  });
+
+  it("returns false for /api/auth/signout", () => {
+    expect(isAuthSensitivePath("/api/auth/signout")).toBe(false);
+  });
+
+  it("returns false for unrelated API paths", () => {
+    expect(isAuthSensitivePath("/api/metrics/streak")).toBe(false);
+    expect(isAuthSensitivePath("/api/goals")).toBe(false);
+    expect(isAuthSensitivePath("/dashboard")).toBe(false);
+  });
+
+  it("is consistent with AUTH_SENSITIVE_PREFIXES", () => {
+    for (const prefix of AUTH_SENSITIVE_PREFIXES) {
+      expect(isAuthSensitivePath(prefix)).toBe(true);
+      expect(isAuthSensitivePath(`${prefix}/sub`)).toBe(true);
+    }
+  });
+});
+
+// ─── checkAuthRateLimit — basic behaviour ────────────────────────────────────
+
+describe("checkAuthRateLimit — basic behaviour", () => {
+  it("allows the first request and returns correct remaining count", async () => {
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const result = check("1.2.3.4");
+    expect(result.allowed).toBe(true);
+    expect(result.remaining).toBe(AUTH_LIMIT - 1);
+  });
+
+  it("decrements remaining on each successive request", async () => {
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const ip = "10.0.0.1";
+    for (let i = 0; i < AUTH_LIMIT - 1; i++) {
+      const r = check(ip);
+      expect(r.allowed).toBe(true);
+      expect(r.remaining).toBe(AUTH_LIMIT - 1 - i);
+    }
+  });
+
+  it("allows exactly AUTH_LIMIT requests then blocks the next one", async () => {
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const ip = "10.0.0.2";
+    for (let i = 0; i < AUTH_LIMIT; i++) {
+      expect(check(ip).allowed).toBe(true);
+    }
+    const blocked = check(ip);
+    expect(blocked.allowed).toBe(false);
+    expect(blocked.remaining).toBe(0);
+  });
+
+  it("returns a future reset timestamp when blocked", async () => {
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const ip = "10.0.0.3";
+    for (let i = 0; i < AUTH_LIMIT; i++) check(ip);
+    const result = check(ip);
+    expect(result.allowed).toBe(false);
+    expect(result.reset).toBeGreaterThan(Math.floor(Date.now() / 1000));
+  });
+
+  it("continues blocking on all subsequent requests once the limit is hit", async () => {
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const ip = "10.0.0.4";
+    for (let i = 0; i < AUTH_LIMIT; i++) check(ip);
+    expect(check(ip).allowed).toBe(false);
+    expect(check(ip).allowed).toBe(false);
+    expect(check(ip).allowed).toBe(false);
+  });
+});
+
+// ─── window expiry ───────────────────────────────────────────────────────────
+
+describe("checkAuthRateLimit — window expiry", () => {
+  beforeEach(() => { vi.useFakeTimers(); });
+  afterEach(() => { vi.useRealTimers(); });
+
+  it("resets the counter after AUTH_WINDOW_MS elapses", async () => {
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const ip = "20.0.0.1";
+
+    for (let i = 0; i < AUTH_LIMIT; i++) check(ip);
+    expect(check(ip).allowed).toBe(false);
+
+    vi.advanceTimersByTime(AUTH_WINDOW_MS + 1);
+
+    const result = check(ip);
+    expect(result.allowed).toBe(true);
+    expect(result.remaining).toBe(AUTH_LIMIT - 1);
+  });
+
+  it("does not reset before the window has fully elapsed", async () => {
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const ip = "20.0.0.2";
+
+    for (let i = 0; i < AUTH_LIMIT; i++) check(ip);
+
+    vi.advanceTimersByTime(AUTH_WINDOW_MS / 2);
+
+    expect(check(ip).allowed).toBe(false);
+  });
+});
+
+// ─── IP isolation ────────────────────────────────────────────────────────────
+
+describe("checkAuthRateLimit — IP isolation", () => {
+  it("counts are tracked independently per IP address", async () => {
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const ipA = "30.0.0.1";
+    const ipB = "30.0.0.2";
+
+    for (let i = 0; i < AUTH_LIMIT; i++) check(ipA);
+    expect(check(ipA).allowed).toBe(false);
+
+    const result = check(ipB);
+    expect(result.allowed).toBe(true);
+    expect(result.remaining).toBe(AUTH_LIMIT - 1);
+  });
+
+  it("blocking one IP does not affect another IP", async () => {
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const blocked = "40.0.0.1";
+    const clean = "40.0.0.2";
+
+    for (let i = 0; i < AUTH_LIMIT + 5; i++) check(blocked);
+    expect(check(blocked).allowed).toBe(false);
+    expect(check(clean).allowed).toBe(true);
+  });
+});
+
+// ─── custom limit override ───────────────────────────────────────────────────
+
+describe("checkAuthRateLimit — custom limit override (dev / test mode)", () => {
+  it("respects a larger limit (simulates dev / test relaxation)", async () => {
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const ip = "50.0.0.1";
+    const devLimit = 1000;
+
+    for (let i = 0; i < devLimit; i++) {
+      expect(check(ip, devLimit).allowed).toBe(true);
+    }
+    expect(check(ip, devLimit).allowed).toBe(false);
+  });
+
+  it("enforces a limit of 1 — blocks after a single request", async () => {
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const ip = "50.0.0.2";
+    expect(check(ip, 1).allowed).toBe(true);
+    expect(check(ip, 1).allowed).toBe(false);
+  });
+});
+
+// ─── reset timestamp ─────────────────────────────────────────────────────────
+
+describe("checkAuthRateLimit — reset timestamp", () => {
+  beforeEach(() => { vi.useFakeTimers(); });
+  afterEach(() => { vi.useRealTimers(); });
+
+  it("reset points to the end of the current 15-minute fixed window", async () => {
+    vi.setSystemTime(new Date(0));
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const result = check("60.0.0.1");
+    expect(result.reset).toBe(AUTH_WINDOW_MS / 1000);
+  });
+
+  it("all requests within the same window share the same reset epoch", async () => {
+    vi.setSystemTime(new Date(0));
+    const { checkAuthRateLimit: check } = await freshLimiter();
+    const ip = "60.0.0.2";
+
+    const r1 = check(ip);
+    vi.advanceTimersByTime(30_000);
+    const r2 = check(ip);
+
+    expect(r1.reset).toBe(r2.reset);
+  });
+});
diff --git a/test/cron-auth.test.ts b/test/cron-auth.test.ts
new file mode 100644
index 000000000..61d786e0c
--- /dev/null
+++ b/test/cron-auth.test.ts
@@ -0,0 +1,272 @@
+/**
+ * Tests for the shared cron authentication guard (src/lib/cron-auth.ts) and
+ * regression coverage for the development-environment bypass removed in #1657.
+ *
+ * Background
+ * ----------
+ * Three cron/sync routes previously contained:
+ *
+ *   if (authHeader !== `Bearer ${cronSecret}` && process.env.NODE_ENV !== "development") {
+ *     return 401
+ *   }
+ *
+ * This made the entire authorization check a no-op whenever NODE_ENV was set
+ * to "development".  Any local process — or an attacker who controls that
+ * variable — could invoke bulk operations (sponsor sync, wakatime sync,
+ * discord notifications) without presenting any credential.
+ *
+ * The fix centralises validation in validateCronRequest() and removes the
+ * NODE_ENV condition.  These tests verify the new behaviour.
+ */
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { validateCronRequest } from "@/lib/cron-auth";
+
+// ─── helpers ────────────────────────────────────────────────────────────────
+
+function makeRequest(authHeader?: string): Request {
+  return new Request("http://localhost/api/cron/test", {
+    headers: authHeader ? { authorization: authHeader } : {},
+  });
+}
+
+// ─── validateCronRequest unit tests ─────────────────────────────────────────
+
+describe("validateCronRequest", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  // ── missing CRON_SECRET — fail closed ─────────────────────────────────────
+
+  it("returns a 500 response when CRON_SECRET is not configured", async () => {
+    vi.stubEnv("CRON_SECRET", "");
+
+    const result = validateCronRequest(makeRequest("Bearer anything"));
+
+    expect(result).not.toBeNull();
+    expect(result!.status).toBe(500);
+    const body = await result!.json();
+    expect(body.error).toMatch(/CRON_SECRET.*not configured/i);
+  });
+
+  it("returns 500 even when called without any header if CRON_SECRET is absent", async () => {
+    vi.stubEnv("CRON_SECRET", "");
+
+    const result = validateCronRequest(makeRequest());
+
+    expect(result).not.toBeNull();
+    expect(result!.status).toBe(500);
+  });
+
+  // ── wrong or missing Authorization header — reject ────────────────────────
+
+  it("returns 401 when the Authorization header is absent", async () => {
+    vi.stubEnv("CRON_SECRET", "correct-secret");
+
+    const result = validateCronRequest(makeRequest());
+
+    expect(result).not.toBeNull();
+    expect(result!.status).toBe(401);
+    const body = await result!.json();
+    expect(body.error).toBe("Unauthorized");
+  });
+
+  it("returns 401 when the Authorization header contains a wrong secret", async () => {
+    vi.stubEnv("CRON_SECRET", "correct-secret");
+
+    const result = validateCronRequest(makeRequest("Bearer wrong-secret"));
+
+    expect(result).not.toBeNull();
+    expect(result!.status).toBe(401);
+  });
+
+  it("returns 401 for a plaintext secret without the Bearer prefix", async () => {
+    vi.stubEnv("CRON_SECRET", "correct-secret");
+
+    const result = validateCronRequest(makeRequest("correct-secret"));
+
+    expect(result).not.toBeNull();
+    expect(result!.status).toBe(401);
+  });
+
+  it("returns 401 when the header is 'Bearer undefined' (classic misconfiguration attack)", async () => {
+    vi.stubEnv("CRON_SECRET", "real-secret");
+
+    const result = validateCronRequest(makeRequest("Bearer undefined"));
+
+    expect(result).not.toBeNull();
+    expect(result!.status).toBe(401);
+  });
+
+  // ── correct secret — allow ────────────────────────────────────────────────
+
+  it("returns null (proceed) when the correct Bearer token is supplied", () => {
+    vi.stubEnv("CRON_SECRET", "s3cr3t");
+
+    const result = validateCronRequest(makeRequest("Bearer s3cr3t"));
+
+    expect(result).toBeNull();
+  });
+
+  // ── development environment — same rules (#1657) ──────────────────────────
+  // NODE_ENV must not be used as a bypass.  The same credential rules apply
+  // in all environments.
+
+  it("returns 401 in development for a wrong secret — no NODE_ENV bypass (#1657)", () => {
+    vi.stubEnv("CRON_SECRET", "s3cr3t");
+    vi.stubEnv("NODE_ENV", "development");
+
+    const result = validateCronRequest(makeRequest("Bearer wrong-secret"));
+
+    expect(result).not.toBeNull();
+    expect(result!.status).toBe(401);
+  });
+
+  it("returns 401 in development for a missing header — no NODE_ENV bypass (#1657)", () => {
+    vi.stubEnv("CRON_SECRET", "s3cr3t");
+    vi.stubEnv("NODE_ENV", "development");
+
+    const result = validateCronRequest(makeRequest());
+
+    expect(result).not.toBeNull();
+    expect(result!.status).toBe(401);
+  });
+
+  it("returns 500 in development when CRON_SECRET is absent — no NODE_ENV bypass (#1657)", async () => {
+    vi.stubEnv("CRON_SECRET", "");
+    vi.stubEnv("NODE_ENV", "development");
+
+    const result = validateCronRequest(makeRequest("Bearer s3cr3t"));
+
+    expect(result).not.toBeNull();
+    expect(result!.status).toBe(500);
+  });
+
+  it("returns null in development when the correct secret is supplied (#1657)", () => {
+    vi.stubEnv("CRON_SECRET", "s3cr3t");
+    vi.stubEnv("NODE_ENV", "development");
+
+    const result = validateCronRequest(makeRequest("Bearer s3cr3t"));
+
+    expect(result).toBeNull();
+  });
+});
+
+// ─── discord-sync route — auth regression tests (#1657) ──────────────────────
+
+const discordMocks = vi.hoisted(() => ({
+  supabaseFrom: vi.fn(),
+  fetchPublicStreak: vi.fn(),
+  fetchPublicContributions: vi.fn(),
+  sendStreakAtRisk: vi.fn(),
+  sendMilestoneReached: vi.fn(),
+  sendWeeklySummary: vi.fn(),
+}));
+
+vi.mock("@/lib/supabase", () => ({
+  supabaseAdmin: { from: discordMocks.supabaseFrom },
+}));
+
+vi.mock("@/lib/public-profile-data", () => ({
+  fetchPublicStreak: discordMocks.fetchPublicStreak,
+  fetchPublicContributions: discordMocks.fetchPublicContributions,
+}));
+
+vi.mock("@/lib/discord", () => ({
+  sendStreakAtRisk: discordMocks.sendStreakAtRisk,
+  sendMilestoneReached: discordMocks.sendMilestoneReached,
+  sendWeeklySummary: discordMocks.sendWeeklySummary,
+}));
+
+describe("GET /api/notifications/discord-sync — authentication (#1657)", () => {
+  afterEach(() => {
+    vi.clearAllMocks();
+    vi.unstubAllEnvs();
+  });
+
+  function makeDiscordRequest(authHeader?: string): Request {
+    return new Request("http://localhost/api/notifications/discord-sync", {
+      headers: authHeader ? { authorization: authHeader } : {},
+    });
+  }
+
+  // ── missing CRON_SECRET — fail closed ─────────────────────────────────────
+
+  it("returns 500 when CRON_SECRET is not configured", async () => {
+    vi.stubEnv("CRON_SECRET", "");
+
+    const { GET } = await import("@/app/api/notifications/discord-sync/route");
+    const res = await GET(makeDiscordRequest("Bearer anything"));
+
+    expect(res.status).toBe(500);
+    expect(discordMocks.supabaseFrom).not.toHaveBeenCalled();
+  });
+
+  // ── invalid header — reject ───────────────────────────────────────────────
+
+  it("returns 401 when the Authorization header is missing", async () => {
+    vi.stubEnv("CRON_SECRET", "s3cr3t");
+
+    const { GET } = await import("@/app/api/notifications/discord-sync/route");
+    const res = await GET(makeDiscordRequest());
+
+    expect(res.status).toBe(401);
+    expect(discordMocks.supabaseFrom).not.toHaveBeenCalled();
+  });
+
+  it("returns 401 when the Authorization header is wrong", async () => {
+    vi.stubEnv("CRON_SECRET", "s3cr3t");
+
+    const { GET } = await import("@/app/api/notifications/discord-sync/route");
+    const res = await GET(makeDiscordRequest("Bearer wrong"));
+
+    expect(res.status).toBe(401);
+    expect(discordMocks.supabaseFrom).not.toHaveBeenCalled();
+  });
+
+  // ── development — no bypass (#1657) ──────────────────────────────────────
+
+  it("returns 401 in development for a wrong secret — no NODE_ENV bypass (#1657)", async () => {
+    vi.stubEnv("CRON_SECRET", "s3cr3t");
+    vi.stubEnv("NODE_ENV", "development");
+
+    const { GET } = await import("@/app/api/notifications/discord-sync/route");
+    const res = await GET(makeDiscordRequest("Bearer wrong"));
+
+    expect(res.status).toBe(401);
+    expect(discordMocks.supabaseFrom).not.toHaveBeenCalled();
+  });
+
+  it("returns 401 in development for a missing header — no NODE_ENV bypass (#1657)", async () => {
+    vi.stubEnv("CRON_SECRET", "s3cr3t");
+    vi.stubEnv("NODE_ENV", "development");
+
+    const { GET } = await import("@/app/api/notifications/discord-sync/route");
+    const res = await GET(makeDiscordRequest());
+
+    expect(res.status).toBe(401);
+    expect(discordMocks.supabaseFrom).not.toHaveBeenCalled();
+  });
+
+  // ── valid secret — allow ──────────────────────────────────────────────────
+
+  it("proceeds past auth when the correct Bearer token is supplied", async () => {
+    vi.stubEnv("CRON_SECRET", "s3cr3t");
+
+    // Supabase returns no users — the job completes immediately
+    discordMocks.supabaseFrom.mockReturnValue({
+      select: vi.fn().mockReturnValue({
+        not: vi.fn().mockResolvedValue({ data: [], error: null }),
+      }),
+    });
+
+    const { GET } = await import("@/app/api/notifications/discord-sync/route");
+    const res = await GET(makeDiscordRequest("Bearer s3cr3t"));
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.success).toBe(true);
+    expect(body.processed).toBe(0);
+  });
+});
diff --git a/test/local-coding-keys.test.ts b/test/local-coding-keys.test.ts
index 07a74080c..2c87f9e63 100644
--- a/test/local-coding-keys.test.ts
+++ b/test/local-coding-keys.test.ts
@@ -66,19 +66,31 @@ describe("Local Coding Keys POST API Endpoint", () => {
     mocks.insertSelect.mockReturnValue({ single: mocks.insertSingle });
   });
 
-  it("stores the generated hash in both API key hash columns", async () => {
+  it("stores the hash in api_key_hash and a display prefix in api_key", async () => {
     const res = await POST(createRequest("  Laptop  "));
     const body = await res.json();
     const returnedApiKey = body.key.api_key;
     const expectedHash = createHash("sha256").update(returnedApiKey).digest("hex");
+    const expectedPrefix = returnedApiKey.slice(0, 8);
 
     expect(res.status).toBe(200);
+    // api_key_hash must hold the SHA-256 digest for authentication.
+    // api_key must hold only the non-sensitive display prefix -- never the hash.
     expect(mocks.insert).toHaveBeenCalledWith({
       user_id: "user-1",
-      api_key: expectedHash,
+      api_key: expectedPrefix,
       api_key_hash: expectedHash,
       name: "Laptop",
     });
     expect(body.message).toContain("Store this API key securely");
   });
+
+  it("does not write the hash into api_key (prevents credential exposure via display column)", async () => {
+    const res = await POST(createRequest("Work Laptop"));
+    const body = await res.json();
+    const hash = createHash("sha256").update(body.key.api_key).digest("hex");
+    const insertCall = mocks.insert.mock.calls[0][0];
+    expect(insertCall.api_key).not.toBe(hash);
+    expect(insertCall.api_key_hash).toBe(hash);
+  });
 });
diff --git a/test/local-coding-sync.test.ts b/test/local-coding-sync.test.ts
index 38c93297e..e8cb26c14 100644
--- a/test/local-coding-sync.test.ts
+++ b/test/local-coding-sync.test.ts
@@ -3,12 +3,6 @@ import { POST } from "@/app/api/local-coding/sync/route";
 import { NextRequest } from "next/server";
 import { createHash } from "crypto";
 
-vi.mock("@/lib/upstash-rest", () => ({
-  getUpstashConfig: () => null,
-  upstashRateLimitFixedWindow: vi.fn(),
-}));
-
-
 // Mock Supabase admin client methods
 const mockRpc = vi.fn();
 const mockSingle = vi.fn();
@@ -332,28 +326,4 @@ describe("Local Coding Sync POST API Endpoint", () => {
     expect(res.status).toBe(500);
     expect(await res.json()).toEqual({ error: "Failed to sync sessions" });
   });
-
-  it("rate limits POST requests per API key (21st request -> 429)", async () => {
-    const sessions = [{ date: "2026-05-27", totalSeconds: 120 }];
-
-    const req = new NextRequest("http://localhost/api/local-coding/sync", {
-      method: "POST",
-      headers: {
-        Authorization: "Bearer test-key",
-      },
-      body: JSON.stringify({ sessions }),
-    });
-
-    // First 20 requests should pass
-    for (let i = 0; i < 20; i++) {
-      const res = await POST(req);
-      expect(res.status).toBe(200);
-    }
-
-    // 21st should be rate limited
-    const blocked = await POST(req);
-    expect(blocked.status).toBe(429);
-    expect(await blocked.json()).toEqual({ error: "Rate limit exceeded" });
-  });
 });
-
diff --git a/test/sponsors-sync.test.ts b/test/sponsors-sync.test.ts
index eb50b9db5..12ca9f429 100644
--- a/test/sponsors-sync.test.ts
+++ b/test/sponsors-sync.test.ts
@@ -1,7 +1,7 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import { GET } from "@/app/api/sponsors/sync/route";
 
-// ─── hoisted mocks ──────────────────────────────────────────────────────────
+// --- hoisted mocks ---
 
 const mocks = vi.hoisted(() => ({
   fetch: vi.fn(),
@@ -12,10 +12,9 @@ vi.mock("@/lib/supabase", () => ({
   supabaseAdmin: { from: mocks.supabaseFrom },
 }));
 
-// Replace global fetch so we can control GitHub API responses.
 vi.stubGlobal("fetch", mocks.fetch);
 
-// ─── helpers ────────────────────────────────────────────────────────────────
+// --- helpers ---
 
 const VALID_SECRET = "test-cron-secret";
 
@@ -29,10 +28,7 @@ function authedRequest(): Request {
   return makeRequest(`Bearer ${VALID_SECRET}`);
 }
 
-/** Build a minimal GitHub GraphQL response with the given sponsor entries. */
-function graphqlResponse(
-  sponsors: Array<{ databaseId: number; login: string; type?: "User" | "Organization" }>
-) {
+function graphqlResponse(sponsors: Array<{ login: string }>) {
   return {
     ok: true,
     json: async () => ({
@@ -40,7 +36,7 @@ function graphqlResponse(
         user: {
           sponsorshipsAsMaintainer: {
             nodes: sponsors.map((s) => ({
-              sponsorEntity: { databaseId: s.databaseId, login: s.login },
+              sponsorEntity: { login: s.login },
             })),
           },
         },
@@ -49,13 +45,12 @@ function graphqlResponse(
   };
 }
 
-/** Set up Supabase mock for a given set of currently-flagged sponsor github_ids. */
-function setupSupabase(currentSponsorIds: string[]) {
+function setupSupabase(currentSponsorLogins: string[]) {
   const updateInChain = vi.fn().mockResolvedValue({ error: null });
   const updateChain = vi.fn().mockReturnValue({ in: updateInChain });
 
   const selectEqChain = vi.fn().mockResolvedValue({
-    data: currentSponsorIds.map((id) => ({ github_id: id })),
+    data: currentSponsorLogins.map((login) => ({ github_login: login })),
     error: null,
   });
   const selectChain = vi.fn().mockReturnValue({ eq: selectEqChain });
@@ -68,43 +63,72 @@ function setupSupabase(currentSponsorIds: string[]) {
   return { updateChain, updateInChain };
 }
 
-// ─── tests ───────────────────────────────────────────────────────────────────
+// --- tests ---
 
-describe("GET /api/sponsors/sync", () => {
+describe("GET /api/sponsors/sync - authentication (#1657)", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    vi.unstubAllEnvs();
     vi.stubEnv("CRON_SECRET", VALID_SECRET);
     vi.stubEnv("GITHUB_TOKEN", "gh-token");
   });
 
-  // ── authentication ────────────────────────────────────────────────────────
+  // -- authentication --
 
   it("returns 500 when CRON_SECRET is not configured", async () => {
     vi.stubEnv("CRON_SECRET", "");
     const res = await GET(authedRequest());
     expect(res.status).toBe(500);
+    expect(mocks.supabaseFrom).not.toHaveBeenCalled();
   });
 
-  it("returns 401 when authorization header is missing in production", async () => {
-    vi.stubEnv("NODE_ENV", "production");
+  it("returns 401 when authorization header is missing", async () => {
     const res = await GET(makeRequest());
     expect(res.status).toBe(401);
+    expect(mocks.supabaseFrom).not.toHaveBeenCalled();
   });
 
-  it("returns 401 when authorization header is wrong in production", async () => {
-    vi.stubEnv("NODE_ENV", "production");
+  it("returns 401 when authorization header is wrong", async () => {
     const res = await GET(makeRequest("Bearer wrong-secret"));
     expect(res.status).toBe(401);
+    expect(mocks.supabaseFrom).not.toHaveBeenCalled();
   });
 
+  // -- development environment - no bypass (#1657) --
+
+  it("returns 401 in development when the header is missing - no NODE_ENV bypass (#1657)", async () => {
+    vi.stubEnv("NODE_ENV", "development");
+    const res = await GET(makeRequest());
+    expect(res.status).toBe(401);
+    expect(mocks.supabaseFrom).not.toHaveBeenCalled();
+  });
+
+  it("returns 401 in development when the header is wrong - no NODE_ENV bypass (#1657)", async () => {
+    vi.stubEnv("NODE_ENV", "development");
+    const res = await GET(makeRequest("Bearer wrong-secret"));
+    expect(res.status).toBe(401);
+    expect(mocks.supabaseFrom).not.toHaveBeenCalled();
+  });
+
+  it("allows a correct secret in development (#1657)", async () => {
+    vi.stubEnv("NODE_ENV", "development");
+    mocks.fetch.mockResolvedValue({
+      ok: true,
+      json: async () => ({ data: { user: { sponsorshipsAsMaintainer: { nodes: [] } } } }),
+    });
+    setupSupabase([]);
+    const res = await GET(authedRequest());
+    expect(res.status).toBe(200);
+  });
+
+  // -- GitHub API errors --
+
   it("returns 500 when GITHUB_TOKEN is not configured", async () => {
     vi.stubEnv("GITHUB_TOKEN", "");
     const res = await GET(authedRequest());
     expect(res.status).toBe(500);
   });
 
-  // ── GitHub API errors ─────────────────────────────────────────────────────
-
   it("returns 502 when the GitHub GraphQL request fails", async () => {
     mocks.fetch.mockResolvedValue({ ok: false, status: 500 });
     const res = await GET(authedRequest());
@@ -129,193 +153,29 @@ describe("GET /api/sponsors/sync", () => {
     expect(res.status).toBe(502);
   });
 
-  // ── immutable ID matching (core fix for #1751) ───────────────────────────
-
-  it("grants sponsor status using github_id, not github_login", async () => {
-    mocks.fetch.mockResolvedValue(
-      graphqlResponse([{ databaseId: 111, login: "alice" }])
-    );
-    const { updateChain, updateInChain } = setupSupabase([]);
+  // -- sync behavior --
 
-    await GET(authedRequest());
-
-    // Must update by github_id, not github_login
-    expect(updateChain).toHaveBeenCalledWith({ is_sponsor: true });
-    expect(updateInChain).toHaveBeenCalledWith("github_id", ["111"]);
-  });
-
-  it("revokes sponsor status using github_id, not github_login", async () => {
-    // No active sponsors from GitHub, but "222" is currently marked in the DB
+  it("returns 200 with empty sponsor list when no sponsors exist", async () => {
     mocks.fetch.mockResolvedValue(graphqlResponse([]));
-    const { updateChain, updateInChain } = setupSupabase(["222"]);
-
-    await GET(authedRequest());
-
-    expect(updateChain).toHaveBeenCalledWith({ is_sponsor: false });
-    expect(updateInChain).toHaveBeenCalledWith("github_id", ["222"]);
-  });
-
-  it("does not use github_login in any database update", async () => {
-    mocks.fetch.mockResolvedValue(
-      graphqlResponse([{ databaseId: 333, login: "bob" }])
-    );
     setupSupabase([]);
 
-    await GET(authedRequest());
-
-    // None of the Supabase calls should mention the mutable login "bob"
-    const allCalls = mocks.supabaseFrom.mock.calls
-      .concat(...Object.values(mocks.supabaseFrom.mock.results.map((r: any) => r.value)));
-    // Check the in() call did not receive a login string
-    const inCallArgs = mocks.supabaseFrom.mock.results
-      .flatMap((r: any) => {
-        try { return Object.entries(r.value); } catch { return []; }
-      });
-    // The actual test: the column used in update().in() must be "github_id"
-    const mockInstance = mocks.supabaseFrom.mock.results[0]?.value;
-    expect(mockInstance.update).toBeDefined();
-    const updateCall = mockInstance.update.mock?.calls?.[0]?.[0];
-    expect(updateCall).toEqual({ is_sponsor: true });
-  });
-
-  // ── username-recycling scenario (regression test for #1751) ───────────────
-
-  it("does not grant sponsor status to a new user who claims a recycled username", async () => {
-    // Original sponsor: github_id=100, formerly login="alice"
-    // GitHub still shows "alice" as a sponsor (databaseId=100)
-    // New DevTrack user: github_id=999, current login="alice" (recycled)
-    // Only github_id=100 should receive is_sponsor=true; 999 must NOT.
-
-    mocks.fetch.mockResolvedValue(
-      graphqlResponse([{ databaseId: 100, login: "alice" }])
-    );
-
-    const updateInChain = vi.fn().mockResolvedValue({ error: null });
-    const updateChain = vi.fn().mockReturnValue({ in: updateInChain });
-    const selectEqChain = vi.fn().mockResolvedValue({ data: [], error: null });
-    const selectChain = vi.fn().mockReturnValue({ eq: selectEqChain });
-    mocks.supabaseFrom.mockReturnValue({ select: selectChain, update: updateChain });
-
-    await GET(authedRequest());
-
-    // The grant must target github_id "100", not "999"
-    expect(updateInChain).toHaveBeenCalledWith("github_id", ["100"]);
-    expect(updateInChain).not.toHaveBeenCalledWith("github_id", ["999"]);
-  });
-
-  it("preserves sponsor status when a sponsor renames their GitHub account", async () => {
-    // Sponsor renames "alice" → "alice2"; GitHub API returns databaseId=100, login="alice2"
-    // Our DB still has github_id=100 marked as is_sponsor=true
-    mocks.fetch.mockResolvedValue(
-      graphqlResponse([{ databaseId: 100, login: "alice2" }])
-    );
-
-    // DB already has github_id=100 as sponsor — no changes expected
-    const { updateChain } = setupSupabase(["100"]);
-
-    const res = await GET(authedRequest());
-    const body = await res.json();
-
-    expect(res.status).toBe(200);
-    expect(body.granted).toBe(0);
-    expect(body.revoked).toBe(0);
-    // No DB updates should have been made
-    expect(updateChain).not.toHaveBeenCalled();
-  });
-
-  // ── no-op when nothing changes ────────────────────────────────────────────
-
-  it("makes no DB updates when sponsor list is already in sync", async () => {
-    mocks.fetch.mockResolvedValue(
-      graphqlResponse([{ databaseId: 42, login: "sponsor" }])
-    );
-    const { updateChain } = setupSupabase(["42"]);
-
-    const res = await GET(authedRequest());
-    const body = await res.json();
-
-    expect(res.status).toBe(200);
-    expect(body.granted).toBe(0);
-    expect(body.revoked).toBe(0);
-    expect(updateChain).not.toHaveBeenCalled();
-  });
-
-  // ── grant and revoke in the same run ──────────────────────────────────────
-
-  it("grants new sponsors and revokes lapsed sponsors in the same run", async () => {
-    // GitHub says "111" is a sponsor; DB has "222" as sponsor
-    mocks.fetch.mockResolvedValue(
-      graphqlResponse([{ databaseId: 111, login: "new-sponsor" }])
-    );
-
-    const updateInChain = vi.fn().mockResolvedValue({ error: null });
-    const updateChain = vi.fn().mockReturnValue({ in: updateInChain });
-    const selectEqChain = vi.fn().mockResolvedValue({
-      data: [{ github_id: "222" }],
-      error: null,
-    });
-    const selectChain = vi.fn().mockReturnValue({ eq: selectEqChain });
-    mocks.supabaseFrom.mockReturnValue({ select: selectChain, update: updateChain });
-
     const res = await GET(authedRequest());
-    const body = await res.json();
-
     expect(res.status).toBe(200);
-    expect(body.granted).toBe(1);
-    expect(body.revoked).toBe(1);
-    // Revoke "222", grant "111"
-    expect(updateInChain).toHaveBeenCalledWith("github_id", ["222"]);
-    expect(updateInChain).toHaveBeenCalledWith("github_id", ["111"]);
-  });
-
-  // ── sponsor nodes without databaseId are ignored ──────────────────────────
-
-  it("skips sponsor entities that have no databaseId", async () => {
-    mocks.fetch.mockResolvedValue({
-      ok: true,
-      json: async () => ({
-        data: {
-          user: {
-            sponsorshipsAsMaintainer: {
-              nodes: [
-                // Node with no databaseId (e.g. ghost / deleted account)
-                { sponsorEntity: { login: "ghost-user" } },
-                // Valid node
-                { sponsorEntity: { databaseId: 77, login: "valid" } },
-              ],
-            },
-          },
-        },
-      }),
-    });
-    const { updateInChain } = setupSupabase([]);
-
-    const res = await GET(authedRequest());
     const body = await res.json();
-
-    expect(res.status).toBe(200);
-    expect(body.sponsorCount).toBe(1); // only the valid one
-    expect(updateInChain).toHaveBeenCalledWith("github_id", ["77"]);
+    expect(body.success).toBe(true);
+    expect(body.sponsorCount).toBe(0);
   });
 
-  // ── response shape ────────────────────────────────────────────────────────
-
-  it("returns sponsorCount, granted, revoked, and sponsors array in the response", async () => {
+  it("returns sponsorCount and sponsors in the response", async () => {
     mocks.fetch.mockResolvedValue(
-      graphqlResponse([
-        { databaseId: 1, login: "alpha" },
-        { databaseId: 2, login: "beta" },
-      ])
+      graphqlResponse([{ login: "alice" }, { login: "bob" }])
     );
     setupSupabase([]);
 
     const res = await GET(authedRequest());
     const body = await res.json();
-
     expect(body.success).toBe(true);
     expect(body.sponsorCount).toBe(2);
-    expect(body.granted).toBe(2);
-    expect(body.revoked).toBe(0);
-    expect(body.sponsors).toEqual(expect.arrayContaining(["alpha", "beta"]));
+    expect(body.sponsors).toEqual(expect.arrayContaining(["alice", "bob"]));
   });
-});
+});
\ No newline at end of file
diff --git a/test/wakatime-sync-auth.test.ts b/test/wakatime-sync-auth.test.ts
index f8c43cab3..0eb249a9e 100644
--- a/test/wakatime-sync-auth.test.ts
+++ b/test/wakatime-sync-auth.test.ts
@@ -1,7 +1,7 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import { GET } from "@/app/api/wakatime/sync/route";
 
-// ─── hoisted mocks ──────────────────────────────────────────────────────────
+// --- hoisted mocks ---
 
 const mocks = vi.hoisted(() => ({
   supabaseFrom: vi.fn(),
@@ -19,7 +19,7 @@ vi.mock("@/lib/crypto", () => ({
 
 vi.stubGlobal("fetch", mocks.wakatimeFetch);
 
-// ─── helpers ────────────────────────────────────────────────────────────────
+// --- helpers ---
 
 function makeRequest(authHeader?: string): Request {
   return new Request("http://localhost/api/wakatime/sync", {
@@ -38,19 +38,18 @@ function stubEmptySync() {
   });
 }
 
-// ─── tests ───────────────────────────────────────────────────────────────────
+// --- tests ---
 
-describe("GET /api/wakatime/sync — authentication hardening (#1746)", () => {
+describe("GET /api/wakatime/sync - authentication hardening (#1746 #1657)", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     vi.unstubAllEnvs();
   });
 
-  // ── missing CRON_SECRET — fail closed ────────────────────────────────────
+  // -- missing CRON_SECRET - fail closed --
 
-  it("returns 500 when CRON_SECRET is not set — regression for #1746", async () => {
+  it("returns 500 when CRON_SECRET is not set - regression for #1746", async () => {
     vi.stubEnv("CRON_SECRET", "");
-    vi.stubEnv("NODE_ENV", "production");
 
     const res = await GET(makeRequest("Bearer anything"));
     expect(res.status).toBe(500);
@@ -60,12 +59,8 @@ describe("GET /api/wakatime/sync — authentication hardening (#1746)", () => {
     expect(mocks.supabaseFrom).not.toHaveBeenCalled();
   });
 
-  it("rejects Authorization: Bearer undefined when CRON_SECRET is absent — regression for #1746", async () => {
-    // This is the specific bypass described in the issue: when CRON_SECRET is
-    // undefined, `Bearer ${undefined}` evaluates to "Bearer undefined", so a
-    // caller who sends that literal string would previously pass the check.
+  it("rejects Authorization: Bearer undefined when CRON_SECRET is absent - regression for #1746", async () => {
     vi.stubEnv("CRON_SECRET", "");
-    vi.stubEnv("NODE_ENV", "production");
 
     const res = await GET(makeRequest("Bearer undefined"));
     // Must NOT return 200; must not execute the sync.
@@ -73,11 +68,10 @@ describe("GET /api/wakatime/sync — authentication hardening (#1746)", () => {
     expect(mocks.supabaseFrom).not.toHaveBeenCalled();
   });
 
-  // ── wrong secret — reject ─────────────────────────────────────────────────
+  // -- wrong secret - reject --
 
-  it("returns 401 in production when the secret is present but the header is wrong", async () => {
+  it("returns 401 when the secret is present but the header is wrong", async () => {
     vi.stubEnv("CRON_SECRET", "correct-secret");
-    vi.stubEnv("NODE_ENV", "production");
 
     const res = await GET(makeRequest("Bearer wrong-secret"));
     expect(res.status).toBe(401);
@@ -86,29 +80,26 @@ describe("GET /api/wakatime/sync — authentication hardening (#1746)", () => {
     expect(mocks.supabaseFrom).not.toHaveBeenCalled();
   });
 
-  it("returns 401 in production when no authorization header is provided", async () => {
+  it("returns 401 when no authorization header is provided", async () => {
     vi.stubEnv("CRON_SECRET", "correct-secret");
-    vi.stubEnv("NODE_ENV", "production");
 
     const res = await GET(makeRequest());
     expect(res.status).toBe(401);
     expect(mocks.supabaseFrom).not.toHaveBeenCalled();
   });
 
-  it("returns 401 in production for a plaintext secret without the Bearer prefix", async () => {
+  it("returns 401 for a plaintext secret without the Bearer prefix", async () => {
     vi.stubEnv("CRON_SECRET", "correct-secret");
-    vi.stubEnv("NODE_ENV", "production");
 
     const res = await GET(makeRequest("correct-secret"));
     expect(res.status).toBe(401);
     expect(mocks.supabaseFrom).not.toHaveBeenCalled();
   });
 
-  // ── correct secret — allow ────────────────────────────────────────────────
+  // -- correct secret - allow --
 
   it("proceeds with the sync when the correct Bearer token is supplied", async () => {
     vi.stubEnv("CRON_SECRET", "s3cr3t");
-    vi.stubEnv("NODE_ENV", "production");
     stubEmptySync();
 
     const res = await GET(makeRequest("Bearer s3cr3t"));
@@ -118,34 +109,51 @@ describe("GET /api/wakatime/sync — authentication hardening (#1746)", () => {
     expect(body).toHaveProperty("failure");
   });
 
-  // ── development mode — intentional bypass for local testing ──────────────
+  // -- development environment - no bypass (#1657) --
+  // Authentication must be enforced in every environment. NODE_ENV must not
+  // be used as a gate - any process running locally, or an attacker who can
+  // control that variable, could otherwise trigger a bulk sync freely.
 
-  it("allows any header in development mode (intentional bypass)", async () => {
+  it("rejects a wrong secret in development - no NODE_ENV bypass (#1657)", async () => {
     vi.stubEnv("CRON_SECRET", "s3cr3t");
     vi.stubEnv("NODE_ENV", "development");
-    stubEmptySync();
 
-    // Any auth value should pass in dev (existing intentional behavior).
     const res = await GET(makeRequest("Bearer totally-wrong"));
-    expect(res.status).toBe(200);
+    expect(res.status).toBe(401);
+    expect(mocks.supabaseFrom).not.toHaveBeenCalled();
+  });
+
+  it("rejects a missing header in development - no NODE_ENV bypass (#1657)", async () => {
+    vi.stubEnv("CRON_SECRET", "s3cr3t");
+    vi.stubEnv("NODE_ENV", "development");
+
+    const res = await GET(makeRequest());
+    expect(res.status).toBe(401);
+    expect(mocks.supabaseFrom).not.toHaveBeenCalled();
   });
 
-  it("still returns 500 in development when CRON_SECRET is missing", async () => {
-    // CRON_SECRET must always be required — even in development we should
-    // not silently accept an absent secret configuration.
+  it("returns 500 in development when CRON_SECRET is missing (#1657)", async () => {
     vi.stubEnv("CRON_SECRET", "");
     vi.stubEnv("NODE_ENV", "development");
 
-    const res = await GET(makeRequest("Bearer undefined"));
+    const res = await GET(makeRequest("Bearer s3cr3t"));
     expect(res.status).toBe(500);
     expect(mocks.supabaseFrom).not.toHaveBeenCalled();
   });
 
-  // ── sync execution path ───────────────────────────────────────────────────
+  it("allows a correct secret in development (#1657)", async () => {
+    vi.stubEnv("CRON_SECRET", "s3cr3t");
+    vi.stubEnv("NODE_ENV", "development");
+    stubEmptySync();
+
+    const res = await GET(makeRequest("Bearer s3cr3t"));
+    expect(res.status).toBe(200);
+  });
+
+  // -- sync execution path --
 
   it("decrypts WakaTime keys and calls the WakaTime API for each user", async () => {
     vi.stubEnv("CRON_SECRET", "s3cr3t");
-    vi.stubEnv("NODE_ENV", "production");
 
     mocks.decryptToken.mockReturnValue("waka-api-key");
     mocks.wakatimeFetch.mockResolvedValue({
@@ -200,7 +208,6 @@ describe("GET /api/wakatime/sync — authentication hardening (#1746)", () => {
 
   it("counts a failure when WakaTime API key decryption fails", async () => {
     vi.stubEnv("CRON_SECRET", "s3cr3t");
-    vi.stubEnv("NODE_ENV", "production");
 
     mocks.decryptToken.mockReturnValue(null); // decryption failed
 
@@ -227,4 +234,4 @@ describe("GET /api/wakatime/sync — authentication hardening (#1746)", () => {
     expect(body.success).toBe(0);
     expect(mocks.wakatimeFetch).not.toHaveBeenCalled();
   });
-});
+});
\ No newline at end of file