Homepage crashes with client-side exception when GitHub contributors API is rate-limited (403)

[tomgoren-gusto]

Description

Visiting https://granted.dev/ sometimes shows a generic Next.js error page: "Application error: a client-side exception has occurred."

Root cause (from browser console)

The homepage fetches contributor avatars client-side, unauthenticated, directly from GitHub's REST API:

GET https://api.github.com/repositories/459240458/contributors

Unauthenticated requests to this endpoint are rate-limited to 60/hour per IP. When the limit is hit, GitHub returns 403 with a JSON error body (e.g. {"message": "API rate limit exceeded..."}) instead of an array of contributors.

The AvatarGrid component then calls .sort() on that response, assuming it's always an array:

TypeError: s.sort is not a function
    at AvatarGrid (index-fa12898f5a376762.js:1:10409)

This uncaught exception crashes the whole page render (Next.js client-side exception).

Steps to reproduce

1. Exhaust the unauthenticated GitHub API rate limit for your IP (60 req/hr), or share a NAT/VPN egress IP with others who have.
2. Visit https://granted.dev/.
3. Page fails to render, browser console shows the 403 on /repositories/459240458/contributors followed by TypeError: s.sort is not a function in AvatarGrid.

Suggested fix

• Guard the contributors fetch: check Array.isArray(response) (or check response.ok) before calling .sort(), and render a fallback/empty state on failure instead of throwing.
• Longer-term: proxy the GitHub contributors call through a server-side route/edge function using a GitHub token, so it isn't subject to the low unauthenticated rate limit and can be cached.

Environment

• Browser: Chrome (desktop)
• Date observed: 2026-07-14