- Default DEBUG to False instead of True - Generate random SECRET_KEY if not set (no hardcoded fallback) - Configure CORS origins from env instead of wildcard - Default host to 127.0.0.1 instead of 0.0.0.0 - Add security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection) |
||
|---|---|---|
| .. | ||
| app | ||
| scripts | ||
| pyproject.toml | ||
| requirements.txt | ||
| run.py | ||
| uv.lock | ||