diff --git a/scripts/createTestStudent.ts b/scripts/createTestStudent.ts
index 9ace4d8..6b4534a 100644
--- a/scripts/createTestStudent.ts
+++ b/scripts/createTestStudent.ts
@@ -6,7 +6,7 @@ import { GroupSchema } from '../src/lib/schema/group';
 import { ProfileSchema } from '../src/lib/schema/profile';
 import { adminDb } from '../src/lib/server/firebase'; // 假設有一個 Firebase store 模組
 
-const sessionId = 'tWwNvzhumqTFS4YMF6Cu';
+const sessionId = 'QMTXcFCAIQu3EeDRv8kD';
 const numberOfStudents = 40;
 const numberOfGroups = 8;
 
diff --git a/src/routes/api/session/[id]/group/[group_number]/conversations/[conv_id]/chat/+server.ts b/src/routes/api/session/[id]/group/[group_number]/conversations/[conv_id]/chat/+server.ts
index d8ee8dd..02c2dbb 100644
--- a/src/routes/api/session/[id]/group/[group_number]/conversations/[conv_id]/chat/+server.ts
+++ b/src/routes/api/session/[id]/group/[group_number]/conversations/[conv_id]/chat/+server.ts
@@ -39,6 +39,10 @@ export const POST: RequestHandler = async ({ request, params, locals }) => {
 
 		const { content, audio } = await getRequestData(request);
 		console.log('Parsed request data', { contentLength: content.length, hasAudio: !!audio });
+		if (content.length > 500) {
+			console.log('Content too long:', content.length);
+			throw error(400, 'Content too long');
+		}
 
 		await conversation_ref.update({
 			history: [
diff --git a/src/routes/api/template/[id]/resource/+server.ts b/src/routes/api/template/[id]/resource/+server.ts
index d7f9c7b..6cee7c7 100644
--- a/src/routes/api/template/[id]/resource/+server.ts
+++ b/src/routes/api/template/[id]/resource/+server.ts
@@ -53,6 +53,9 @@ export const POST: RequestHandler = async ({ params, request, locals }) => {
 		if (type === 'file') {
 			const fileProcessingStart = Date.now();
 			const file = content as File;
+			if (file.size > 10 * 1024 * 1024) {
+				return json({ error: 'File size limit exceeded' }, { status: 400 });
+			}
 			const buffer = await file.arrayBuffer();
 			const text = await pdf2Text(buffer, env.LLAMA_CLOUD_API_KEY!);
 			console.log(`PDF text extraction took ${Date.now() - fileProcessingStart}ms`);