diff --git a/README.md b/README.md
index d017bf0..3c673ca 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,10 @@
 
 > Boilerplate for how I like to write a backend web service
 
+## Build
+
 ```bash
+export GOFLAGS="-mod=vendor"
 go mod tidy
 go mod vendor
 go generate -mod=vendor ./...
diff --git a/main.go b/main.go
index c2093a1..babfbe3 100644
--- a/main.go
+++ b/main.go
@@ -92,6 +92,8 @@ func main() {
 	}
 }
 
+var defaultMaxBytes int64 = 1 << 20
+
 func serve() {
 	r := chi.NewRouter()
 
@@ -105,6 +107,10 @@ func serve() {
 	r.Use(middleware.Logger)
 	r.Use(middleware.Recoverer)
 
+	r.Route("/api", func(r chi.Router) {
+		r.Use(limitResponseSize)
+	})
+
 	var staticHandler http.HandlerFunc
 	pub := http.FileServer(assets.Assets)
 
@@ -142,3 +148,10 @@ func serve() {
 		return
 	}
 }
+
+func limitResponseSize(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		r.Body = http.MaxBytesReader(w, r.Body, defaultMaxBytes)
+		next.ServeHTTP(w, r)
+	})
+}