Fix: Error Payload Largue

.env.example

@@ -4,6 +4,11 @@ GITDB_ENCRYPTION_KEY=replace-with-a-long-random-secret
 
 ORIGIN=http://localhost:3000
 
+# Maximum request body size accepted by the production server (adapter-node, default 512K).
+# CI scanners POST full reports to /api/code-report/scan; large reports need a higher limit.
+# Accepts K, M or G suffixes. Not enforced by `bun run dev`.
+BODY_SIZE_LIMIT=1M
+
 # Optional GitDB configuration
 GITDB_BRANCH=main
 GITDB_DATA_PATH=./data/gitdb

.github/copilot-instructions.md

@@ -64,6 +64,11 @@ en produccion, asegurar que las credenciales SSH esten disponibles via `SSH_AUTH
 La variable `ORIGIN` fija el origen de la aplicacion (ej: `http://localhost:3000`) para que el
 CSRF Origin check de SvelteKit no dependa del header Host, previniendo bypass en proxys.
 
+`BODY_SIZE_LIMIT` (adapter-node, default `512K`, acepta sufijos `K`/`M`/`G`) limita el tamaño de
+cuerpos de solicitud en el servidor compilado (`node build`); solicitudes mas grandes fallan con
+`413 Payload Too Large`. `/api/code-report/scan` recibe reportes completos de scanners de CI, por
+lo que en produccion se debe aumentar (ej: `1M` o mas). `bun run dev` no lo enforce.
+
 ## RBAC y seguridad
 
 Los permisos usan `section:action` con scope global, de organizacion o de proyecto. Usar siempre

CLAUDE.md

@@ -97,6 +97,12 @@ Bitbucket, and GitLab; in production, ensure SSH authentication credentials are
 SvelteKit's CSRF Origin check depends on this value instead of deriving it from the incoming Host
 header, preventing bypasses when running behind a proxy that rewrites Host headers.
 
+`BODY_SIZE_LIMIT` (adapter-node, default `512K`, accepts `K`/`M`/`G`) caps request bodies in the
+built server (`node build`); larger requests fail with `{"message":"Payload Too Large"}` (413).
+`/api/code-report/scan` receives full scanner reports from CI, so deployments should raise it
+(e.g. `1M` or more). `bun run dev` does not enforce it. If a reverse proxy sits in front of
+GitOps, raise its body size limit as well (e.g. nginx `client_max_body_size`).
+
 ## Authorization
 
 Permission grants are always scope-prefixed and match the catalog in `src/lib/config/permissions.ts`

README.md

@@ -41,6 +41,11 @@ docker compose up --build
 
 The container is available at `http://localhost:3000` and stores persistent data in `./data`.
 
+The production server rejects request bodies larger than `BODY_SIZE_LIMIT` (default `512K`) with
+`413 Payload Too Large`. CI scanners send full reports to `/api/code-report/scan`, so raise it
+(for example `BODY_SIZE_LIMIT=1M` or higher) if scans fail with that error. If a reverse proxy sits
+in front of GitOps, raise its body size limit as well (e.g. nginx `client_max_body_size`).
+
 ## Development
 
 ```bash