fault111
## Summary The template ships with `ENVIRONMENT` defaulting to `"local"` in `backend/app/core/config.py:38`. When this default is active, the private router mounts at `POST /api/v1/private/users/` with zero authentication. Any dev who builds the Docker stack and exposes port 8000 without explicitly setting `ENVIRONMENT=production` has an open account-creation endpoint. ## Vulnerable Lines **`backend/app/core/config.py:38`** ```python ENVIRONMENT: Literal["local", "staging", "production"] = "local" ``` **`backend/app/api/main.py:13-14`** ```python if settings.ENVIRONMENT == "local": api_router.include_router(private_router) # no auth, open in default config ``` **`backend/app/api/routes/private.py`** — creates a full user account with no authentication check whatsoever. ## Real-world Impact `docker-compose.yml` binds to `0.0.0.0`. A dev who spins this up on a VPS or EC2 instance for testing without setting `ENVIRONMENT=production` in their `.env` exposes the endpoint to the world: ```bash curl -X POST https://target.example.com/api/v1/private/users/ \ -H 'Content-Type: application/json' \ -d '{"email": "[email protected]", "password": "P@ssword1", "full_name": "attacker", "is_superuser": true}' # 200 — account created, no credentials required ``` ## Fix Change the default: ```python ENVIRONMENT: Literal["local", "staging", "production"] = "production" ``` And note it prominently in the README as a required deployment step. --- Reported by Fault (@fault111)