fix(security): harden public-deploy footguns + browser-CSRF on /v1/*#3492

Open

mohamed-elkholy95 wants to merge 2 commits intoHKUDS:nightlyfrom

mohamed-elkholy95:fix/security-public-deploy-hardening

Commits on May 3, 2026

fix(security): harden public-deploy footguns on WebUI bootstrap and API serve
mohamed-elkholy95
committed
fix(security): block browser-CSRF on /v1/* even on loopback
mohamed-elkholy95
committed