- Shipped
- October 4, 2026 at 6:06 PM UTC
- Author
- Kamo
- Commit
- 76851f1
POST /api/public-chat/contact proxies to MediaService's new contact endpoint through the same site-key, origin and scope checks as every other public-chat call, so a lender's contact form files a ticket in that lender's own support queue. It creates a session and a ticket, so it guards the *** like its siblings and draws on the strict creation budget (3/min per IP). It is the one creating path without "sessions" in it, so it is matched by name; left to the message budget a script could file 30 tickets a minute from one address.