No wildcard CORS origin

CORS origins from env var

Explicit allow_methods

allow_credentials not with wildcard

TrustedHostMiddleware present

Trusted hosts from env var

Security headers middleware

All four security headers present

Correct header values

Middleware calls call_next

All 7 security components present

HTTPS redirect before TrustedHost

TrustedHost before CORS

CORS before security headers

Security headers before routes

CORS origins not wildcard

CORS and hosts from env vars

All four security headers set

Rate limit error code

Pydantic Field constraints on models

app.state.limiter set

HTTPSRedirectMiddleware imported

HTTPS middleware added conditionally

Production env check

uvicorn request size limit set

Request size limit is 1MB

Security headers middleware present

TrustedHostMiddleware present

CORS middleware present

Rate limiting present

Field import used

String min_length constraint

String max_length constraint

Integer range constraint

Pattern for enum-like field

field_validator used

classmethod decorator

ValueError raised on invalid input

No unconstrained string fields

No unconstrained integer fields

slowapi Limiter used

get_remote_address key function

app.state.limiter assigned

RateLimitExceeded handler present

429 status code returned

RATE_LIMITED error code

Limiter decorator on routes

request param is first

Stricter limit on auth endpoint

Stricter limit on mutation endpoint

Rate limiting on POST/auth routes