From c092dd9ac62f17574345167f5a4a96ba7c15d65b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 28 Mar 2026 20:37:25 +0000
Subject: [PATCH] fix: suppress bandit B104 false positive for 0.0.0.0 binding
 in config.py

Agent-Logs-Url: https://github.com/christianlouis/InboxConverge/sessions/3b265b6d-865c-4453-b22c-60feff2aa049

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 CHANGELOG.md               | 4 ++++
 backend/app/core/config.py | 4 +++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 45bf03b..f019c60 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- Suppress bandit B104 false positive for `HOST = "0.0.0.0"` in `config.py`; binding to all interfaces is intentional for containerised deployments.
+
 ### Fixed
 
 - Fix timezone display in Mailbox Activity / Admin Logs pages: timestamps from the server were parsed as local time when no timezone indicator was present, causing relative times ("1h ago") and absolute dates to be shifted by the client's UTC offset.
diff --git a/backend/app/core/config.py b/backend/app/core/config.py
index 44b2cea..9d12315 100644
--- a/backend/app/core/config.py
+++ b/backend/app/core/config.py
@@ -36,7 +36,9 @@ class Settings(BaseSettings):
     API_V1_PREFIX: str = "/api/v1"
 
     # Server
-    HOST: str = "0.0.0.0"
+    HOST: str = (
+        "0.0.0.0"  # nosec B104 – intentional: containerised service binds all interfaces
+    )
     PORT: int = 8000
 
     # Database