[LOW] No API response compression (gzip/brotli)

[kilodesodiq-arch]

Engineering Gap

No response compression middleware configured in NestJS. Large JSON responses (campaign lists, claim exports) sent uncompressed over the network.

Codebase Evidence

• app/backend/src/main.ts: Helmet, CORS, rate limiting configured but no compression
• app/backend/package.json: No compression middleware dependency

Risk Profile

Higher bandwidth usage. Slower API responses on slow connections.

Remediation Strategy

Add compression middleware using NestJS compression package. Enable gzip and brotli. Exclude already-compressed types (images).

Success Conditions

• Compression middleware added
• gzip and brotli enabled
• Response sizes reduced

Change Surface

Files: main.ts, package.json

Security Review

Compression can enable BREACH attack on reflected secrets — ensure no secrets in response bodies.

Completion Checklist

• Implementation completed
• Peer reviewed
• Ready for merge

[xx7412421-cloud]

Hi, I would like to work on this issue if it is still available.

Planned approach:

• Add compression middleware in the NestJS backend entrypoint after checking the existing Helmet/CORS/rate-limit setup.
• Configure gzip response compression for JSON/API responses while avoiding already-compressed/static asset types.
• Add focused validation or documentation showing the expected response-size reduction and the BREACH-related guardrails for reflected sensitive data.
• Keep the PR scoped to app/backend/src/main.ts, app/backend/package.json, and any minimal docs needed for review.

I will wait for assignment before opening a PR so this follows the GrantFox workflow.