CogniPrep keeps a GDPR audit log: one append-only Postgres table that records exports, deletions, consent and profile changes, so an account can answer "what has been done with my data". The settings page offers to download it, and the copy reads:

Download a record of all privacy-related actions

The button behind that sentence does this:

// Fetch all activity logs (no pagination limit for export) const response = await fetch ( ' /api/user/audit-log?limit=1000 ' );

Enter fullscreen mode

Exit fullscreen mode

And the route it calls does this:

const limit = Math . min ( parseInt ( searchParams . get ( ' limit ' ) || ' 20 ' , 10 ), 100 ); // Max 100 per request const offset = Math . max ( parseInt ( searchParams . get ( ' offset ' ) || ' 0 ' , 10 ), 0 );

Enter fullscreen mode

Exit fullscreen mode

Math.min(1000, 100) is 100. The request is honoured, the response is a valid 200, and the downloaded file is the most recent 100 rows of a table that grows on every data access.…