1 files changed, 9 insertions, 5 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
index b1a22f7..c44888a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
@@ -2,7 +2,7 @@
 
 import re
 
-from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from pydantic import BaseModel
 from datetime import datetime, timezone
 from sqlalchemy import func, or_, select, update
@@ -140,9 +140,12 @@ async def group_online_nodes(
 @router.get("")
 async def list_public_groups(
     db: AsyncSession = Depends(get_db),
-    q: str = "",
-    limit: int = 50,
-    offset: int = 0,
+    q: str = Query(default="", max_length=200),
+    # This one takes no authentication at all, and had no upper bound: any
+    # stranger could ask the hub for the entire public directory in a single
+    # query, repeatedly. Bounded like every list in admin.py.
+    limit: int = Query(default=50, ge=1, le=200),
+    offset: int = Query(default=0, ge=0),
     include_federated: bool = True,
 ):
     """List/search public groups — local and optionally federated. No auth required."""
@@ -777,7 +780,8 @@ async def invite_notify(
         return {"status": "no_email"}
 
     try:
-        mail.send_invite_notification(
+        await mail.send_off_loop(
+            mail.send_invite_notification,
             email, body.code, current_user.username, group.name)
     except Exception:
         return {"status": "send_failed"}