get_json(silent=True) used

None body returns 400

title presence check

title max length check

title stripped

author presence check

author max length check

year type and range check

tags list type check

tags element check

400 JSON error response

Valid request succeeds

CORS extension used

No wildcard CORS

CORS env var origins

Talisman / security headers

Rate limiter initialized

Global rate limit 200/hour

POST endpoint rate limited

DELETE endpoint rate limited

SECRET_KEY from env

Startup check for SECRET_KEY

Debug mode disabled

requirements.txt present

Wildcard CORS identified

Hardcoded secret identified

Debug mode identified

Permissive rate limit identified

Missing per-route limits identified

CORS fixed with env var

SECRET_KEY from env

SECRET_KEY startup guard

Global rate limit corrected

POST route limited

PATCH route limited

DELETE route limited

Debug mode disabled

Routes preserved

Both files present

Talisman imported

Talisman instantiated

Talisman applied to app

force_https=False

session_cookie_secure=True

session_cookie_http_only=True

flask-talisman in requirements

Original routes preserved

No force_https=True

500 handler registered

500 returns generic message

500 returns correct status code

No str(e) in 500 response

app.logger.exception() called

404 handler registered

404 returns JSON

404 returns correct status code

Original routes preserved

create_app function defined

CORS init_app used

Talisman init_app used

Talisman force_https=False preserved

Limiter init_app used

CORS origins preserved

SECRET_KEY guard inside factory

Original routes preserved

No module-level app = Flask(...)

Redis storage_uri preserved

ProxyFix imported

ProxyFix applied

ProxyFix x_for=1

ProxyFix x_proto=1 and x_host=1

Redis storage_uri present

No in-memory default

IP diagnosis mentioned

Multi-worker diagnosis mentioned

Redis fix rationale

requirements.txt present

Existing routes preserved

SESSION_COOKIE_SECURE=True

SESSION_COOKIE_HTTPONLY=True

SESSION_COOKIE_SAMESITE='Lax'

user_id stored in session

role NOT in session

hr_api_token NOT in session

salary_band NOT in session

password NOT in session

me endpoint uses session

logout clears session