Security defaults that belong in every FastAPI application from day one.
93
90%
Does it follow best practices?
Impact
98%
7.00xAverage score across 5 eval scenarios
Passed
No known issues
A startup is building a community forum. The frontend is a React single-page application hosted at https://forum.example.com, and the backend is a new FastAPI service on a separate domain. Users will post questions and answers through the frontend, which calls the API.
The same codebase needs to run in staging and production without code changes -- origins and hostnames differ per environment and should come from environment variables.
Produce a single Python file named main.py that:
/posts and POST /posts)https://forum.example.com must be able to call the API from the browserThe file should be complete and runnable (all imports present). You do not need to implement real database logic -- stubs or placeholder return values are fine.
evals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
fastapi-security-basics
verifiers