Security defaults that belong in every FastAPI application from day one.
93
90%
Does it follow best practices?
Impact
98%
7.00xAverage score across 5 eval scenarios
Passed
No known issues
A social networking platform wants to add profile photo uploads to their FastAPI backend. Users can upload a photo when creating or editing their profile. The service will be deployed to a production cloud environment, but developers also run it locally. The same codebase must work in both environments without modification -- environment variables distinguish local from production.
The upload endpoint has been abused before by clients sending very large payloads that exhausted server memory.
Produce a Python file named main.py that:
POST /profile/photo for uploading a photo)if __name__ == "__main__": block that starts the application with uvicornStub the actual file handling -- you do not need to save files to disk or call any external service. The file must be complete and runnable Python.
evals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
fastapi-security-basics
verifiers