implemented a lot of security measures

routes/api.php

@@ -108,6 +108,10 @@ Route::prefix('v1')->name('api.v1.')->group(function () {
             ->middleware('signed')
             ->name('photo-shares.asset');
         Route::post('/events/{token}/upload', [EventPublicController::class, 'upload'])->name('events.upload');
+        Route::get('/branding/asset/{path}', [EventPublicController::class, 'brandingAsset'])
+            ->where('path', '.*')
+            ->middleware('signed')
+            ->name('branding.asset');
 
         Route::get('/gallery/{token}', [EventPublicController::class, 'gallery'])->name('gallery.show');
         Route::get('/gallery/{token}/photos', [EventPublicController::class, 'galleryPhotos'])->name('gallery.photos');

routes/web.php

@@ -338,4 +338,6 @@ Route::middleware('auth')->group(function () {
     Route::post('/paddle/create-checkout', [PaddleCheckoutController::class, 'create'])->name('paddle.checkout.create');
 });
 
-Route::post('/paddle/webhook', [PaddleWebhookController::class, 'handle'])->name('paddle.webhook');
+Route::post('/paddle/webhook', [PaddleWebhookController::class, 'handle'])
+    ->middleware('throttle:paddle-webhook')
+    ->name('paddle.webhook');