fix: cap github caches and sanitize og user injection

Author: riddhima25bet10005-a11y

app/api/og/route.tsx

@@ -37,10 +37,14 @@ function getLuminance(hex: string) {
 
 export async function GET(req: NextRequest) {
   const { searchParams } = new URL(req.url);
-
-  const { user, theme, bg, text, accent } = ogParamsSchema.parse(
+  const parsed = ogParamsSchema.parse(
     Object.fromEntries(searchParams.entries())
   );
+  let { user } = parsed;
+  const { theme, bg, text, accent } = parsed;
+
+  // Sanitize user: limit to 39 chars (GitHub max length) and strip invalid chars
+  user = user.slice(0, 39).replace(/[^a-zA-Z0-9-]/g, '');
 
   const selectedTheme = themes[theme] || themes.dark;
   const resolvedBg = `#${bg || selectedTheme.bg}`;