Merge pull request #116 from christianlouis/copilot/fix-hardcoded-bind-all-interfaces

fix: suppress bandit B104 false positive for intentional 0.0.0.0 binding

CHANGELOG.md

@@ -17,6 +17,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- Suppress bandit B104 false positive for `HOST = "0.0.0.0"` in `config.py`; binding to all interfaces is intentional for containerised deployments.
+
 ### Fixed
 
 - Fix timezone display in Mailbox Activity / Admin Logs pages: timestamps from the server were parsed as local time when no timezone indicator was present, causing relative times ("1h ago") and absolute dates to be shifted by the client's UTC offset.

backend/app/core/config.py

@@ -36,7 +36,9 @@ class Settings(BaseSettings):
     API_V1_PREFIX: str = "/api/v1"
 
     # Server
-    HOST: str = "0.0.0.0"
+    HOST: str = (
+        "0.0.0.0"  # nosec B104 – intentional: containerised service binds all interfaces
+    )
     PORT: int = 8000
 
     # Database