Character limits are enforced client-side but are not consistently applied at the API level (server-side).

• Risk: Allows submission of excessively large payloads, leading to UI disruption (layout/display issues) for other users and a potential resource exhaustion vector under certain conditions.

• Action: Implement mandatory, robust server-side validation to enforce character limits for all relevant input fields, mirroring or exceeding the client-side restrictions.