Prepare Loadpath for public release

[Modsofthenation]

Why

The repo is about to be public. The README buried setup under screenshots, and the local HTTP API was only partially loopback-gated — a page on another origin could hit settings, the filesystem browser, review, and PR comments while loadpath serve was running.

What changed

Security

• /api/* except /api/health rejects non-loopback Origin / Host
• MCP /mcp (and OAuth token routes) reject unexpected Host headers; --public-url host is allowed
• GitHub Action inputs go through environment variables; extra-args shell interpolation is gone
• CI job is contents: read

Docs / community

• README leads with what Loadpath is and is not, then clone → venv → index → serve
• SECURITY.md, CODE_OF_CONDUCT.md, issue templates, Dependabot

After merge (GitHub settings)

These cannot be set from the repo files:

1. Enable private vulnerability reporting
2. Set the repo description to something like: Local load-path review for Django + React PRs. Not a hunk-comment bot.
3. Add topics: django, react, code-review, architecture, mcp

Tests

• Unit/e2e: cross-origin /api is 403, /api/health stays 200, MCP Host: evil.example is 421
• Non-Playwright pytest, UI e2e, desktop unit tests passed locally

  

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 6e7d6a0b-3f40-4019-98d0-6fc5fe52d2f2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands.}