Current state with latest updates

routes/api.php

@@ -61,7 +61,7 @@ Route::middleware(['web', 'throttle:300,1'])
     ->whereNumber('id')
     ->name('api.art.similar');
 
-Route::middleware(['web', 'throttle:120,1'])
+Route::middleware(['web', 'throttle:vector-search'])
     ->get('art/{id}/similar-ai', \App\Http\Controllers\Api\SimilarAiArtworksController::class)
     ->whereNumber('id')
     ->name('api.art.similar-ai');

routes/console.php

@@ -192,7 +192,7 @@ Schedule::command('nova:recalculate-heat')
 // active scheduler in this app is defined in routes/console.php, not Kernel.
 
 // Generate static sitemap XML files that nginx can serve directly without PHP.
-// The generate command writes public/sitemap.xml + public/sitemaps/{name}.xml.
+// The generate command writes public/sitemaps/sitemap.xml + public/sitemaps/{name}.xml.
 Schedule::command('skinbase:sitemaps:generate')
     ->cron('30 10,22 * * *')
     ->name('sitemaps-generate')
@@ -211,6 +211,14 @@ Schedule::command('skinbase:sitemaps:validate')
     ->withoutOverlapping()
     ->runInBackground();
 
+if ((bool) config('security-report.enabled', true)) {
+    Schedule::command('security:scan --notify')
+        ->weeklyOn(1, '05:15')
+        ->name('security-report-weekly-scan')
+        ->withoutOverlapping()
+        ->runInBackground();
+}
+
 // Keep the old release-pipeline cleanup running so stale release artifacts are pruned.
 
 Schedule::job(new \App\Jobs\Sitemaps\CleanupSitemapReleasesJob())

routes/web.php

@@ -419,6 +419,7 @@ Route::get('/collections/program/{programKey}', [\App\Http\Controllers\Web\Colle
 Route::get('/collections/recommended', [\App\Http\Controllers\Web\CollectionDiscoveryController::class, 'recommended'])
     ->name('collections.recommended');
 Route::get('/collections/search', [\App\Http\Controllers\Web\CollectionDiscoveryController::class, 'search'])
+    ->middleware('throttle:search')
     ->name('collections.search');
 
 Route::get('/groups', [\App\Http\Controllers\GroupController::class, 'index'])->name('groups.index');
@@ -1046,7 +1047,9 @@ require __DIR__.'/auth.php';
 require __DIR__.'/legacy.php';
 
 // ── SEARCH ────────────────────────────────────────────────────────────────────
-Route::get('/search', [\App\Http\Controllers\Web\SearchController::class, 'index'])->name('search');
+Route::get('/search', [\App\Http\Controllers\Web\SearchController::class, 'index'])
+    ->middleware('throttle:search')
+    ->name('search');
 
 // ── MISC ──────────────────────────────────────────────────────────────────────
 Route::view('/data-deletion', 'privacy.data-deletion')->name('privacy.data_deletion');
@@ -1108,6 +1111,14 @@ Route::middleware(['auth', 'admin.access'])
         Route::get('/uploads',                     [AdminController::class, 'uploadQueue'])->name('uploads');
         Route::get('/settings',                    [AdminController::class, 'settings'])->name('settings');
         Route::middleware('admin.role')->get('/auth-audit', [AdminController::class, 'authAudit'])->name('auth-audit');
+        Route::middleware('admin.role')
+            ->prefix('system/security-report')
+            ->name('system.security-report.')
+            ->group(function (): void {
+                Route::get('/', [\App\Http\Controllers\Admin\SecurityReportController::class, 'index'])->name('index');
+                Route::post('/run', [\App\Http\Controllers\Admin\SecurityReportController::class, 'run'])->name('run');
+                Route::get('/{securityReport}', [\App\Http\Controllers\Admin\SecurityReportController::class, 'show'])->whereNumber('securityReport')->name('show');
+            });
 
         Route::middleware(['artwork.maturity.access'])
             ->prefix('ai-biography')
@@ -1280,6 +1291,7 @@ Route::middleware(['auth'])
     ->name('feed.saved');
 
 Route::get('/feed/search', [\App\Http\Controllers\Web\Posts\SearchFeedController::class, 'index'])
+    ->middleware('throttle:search')
     ->name('feed.search');
 
 // ── CONTENT BROWSER (artwork / category universal router) ─────────────────────