diff --git a/packages/app/control/src/services/db/apps/membership.ts b/packages/app/control/src/services/db/apps/membership.ts
index 192c1992..2db42c68 100644
--- a/packages/app/control/src/services/db/apps/membership.ts
+++ b/packages/app/control/src/services/db/apps/membership.ts
@@ -186,14 +186,14 @@ export async function setAppMembershipReferrer(
     return false;
   }
 
-  // Validate the referral code exists
+  // Validate the referral code exists and hasn't expired
   const referralCode = await db.referralCode.findUnique({
     where: {
       code,
     },
   });
 
-  if (!referralCode) {
+  if (!referralCode || referralCode.expiresAt < new Date()) {
     return false;
   }
 

Analysis

Missing expiration validation in setAppMembershipReferrer allows expired referral codes to be applied

What fails: The setAppMembershipReferrer() function in packages/app/control/src/services/db/apps/membership.ts does not validate whether a referral code has expired before applying it to a membership.

How to reproduce:

1. Create a referral code with an expiresAt date in the past (code schema supports this via optional expiresAt parameter, defaulting to 1 year in future)
2. Call setAppMembershipReferrer(userId, echoAppId, expiredCode)
3. The function returns true and applies the expired code to the membership

Result: Expired referral codes are accepted and applied. The function succeeds even when referralCode.expiresAt < new Date().

Expected: Function should return false for expired codes, matching the pattern used in other similar functions and the error message which states codes "may be invalid, expired, or you may already have a referrer for this app"

Verification: The same expiration validation pattern is correctly implemented in:

• getCreditGrantCode() in packages/app/control/src/services/db/credits/grant.ts - uses expiresAt: { gt: new Date() } in WHERE clause
• findRefreshToken() in packages/app/control/src/services/db/auth/refresh.ts - uses expiresAt: { gt: new Date() } in WHERE clause

The fix adds the missing expiration check: if (!referralCode || referralCode.expiresAt < new Date())