diff --git a/package.json b/package.json
index 0846bd4..a5317ff 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "lageplan",
-  "version": "1.5.6",
+  "version": "1.5.7",
   "description": "Feuerwehr Lageplan - Krokier-App für Einsatzdokumentation",
   "private": true,
   "scripts": {
diff --git a/src/app/api/projects/[id]/modules/[moduleId]/items/[itemId]/route.ts b/src/app/api/projects/[id]/modules/[moduleId]/items/[itemId]/route.ts
index 43a9209..304670d 100644
--- a/src/app/api/projects/[id]/modules/[moduleId]/items/[itemId]/route.ts
+++ b/src/app/api/projects/[id]/modules/[moduleId]/items/[itemId]/route.ts
@@ -25,9 +25,15 @@ export async function PUT(
     const body = await request.json()
     const patch = body && typeof body.data === 'object' && body.data !== null ? body.data : {}
 
+    const merged = { ...(existing.data || {}), ...patch }
+    // Payload-Härtung: Zeilengrösse begrenzen (DB-Bloat/DoS vermeiden)
+    if (JSON.stringify(merged).length > 20000) {
+      return NextResponse.json({ error: 'Eintrag zu gross' }, { status: 413 })
+    }
+
     const item = await (prisma as any).moduleItem.update({
       where: { id: itemId },
-      data: { data: { ...(existing.data || {}), ...patch } },
+      data: { data: merged },
     })
     return NextResponse.json(item)
   } catch (error) {
diff --git a/src/app/api/projects/[id]/modules/[moduleId]/items/route.ts b/src/app/api/projects/[id]/modules/[moduleId]/items/route.ts
index f3a1e3e..d204019 100644
--- a/src/app/api/projects/[id]/modules/[moduleId]/items/route.ts
+++ b/src/app/api/projects/[id]/modules/[moduleId]/items/route.ts
@@ -38,11 +38,17 @@ export async function POST(
     if (!user) return NextResponse.json({ error: 'Nicht autorisiert' }, { status: 401 })
     if (user.role === 'VIEWER') return NextResponse.json({ error: 'Keine Berechtigung' }, { status: 403 })
 
+    if (moduleId.length > 64) return NextResponse.json({ error: 'Ungültige Modul-ID' }, { status: 400 })
+
     const project = await getProjectWithTenantCheck(id, user)
     if (!project) return NextResponse.json({ error: 'Projekt nicht gefunden' }, { status: 404 })
 
     const body = await request.json()
     const data = body && typeof body.data === 'object' && body.data !== null ? body.data : {}
+    // Payload-Härtung: eine Tabellenzeile bleibt klein — verhindert DB-Bloat/DoS
+    if (JSON.stringify(data).length > 20000) {
+      return NextResponse.json({ error: 'Eintrag zu gross' }, { status: 413 })
+    }
 
     const count = await (prisma as any).moduleItem.count({ where: { projectId: id, moduleId } })
     const item = await (prisma as any).moduleItem.create({