{{ message }}
Repository navigation
HIGH: Web UI has no authentication or CSRF protection #378
Description
The web UI at webui/app.py has zero authentication. Flask-CORS is enabled with default permissive settings. Anyone who can reach the server can load models, scan the filesystem, and run predictions.
Suggested fix: Add authentication (Flask-Login or JWT), restrict CORS origins, add CSRF protection, and rate-limit prediction endpoints.
Activity