🔒 Security: Disable debug mode and implement proper CORS/authentication

[ManvithGopu13]

Security Issues Identified

Critical Issues:

1. Debug mode enabled in production (main.py:30)

   • debug=True exposes stack traces and enables auto-reload
   • Should be controlled via environment variable

2. Unrestricted CORS (main.py:10)

   • CORS(app) allows all origins
   • Should restrict to specific allowed origins

3. No authentication/authorization

   • All endpoints are publicly accessible
   • No API key or token validation

4. Error message exposure

   • Full exception details returned to clients (routes/*.py)
   • Could leak sensitive information

Recommended Fixes:

• Use environment variable for debug mode: app.run(debug=os.getenv('FLASK_DEBUG', 'False') == 'True')
• Configure CORS with allowed origins: CORS(app, origins=['https://yourdomain.com'])
• Implement API key authentication middleware
• Sanitize error messages in production (log full details, return generic messages)

Priority: High
Type: Security