Thanks @TheodorNEngoy — this is well-executed. Both suggestions from the previous review have been properly addressed:

• DRY the port parsing — extracted _env_bool, _env_int, _parse_csv into env_utils.py. Clean.
• Makefile host override — run/dev targets now use $${HOST:-127.0.0.1}. Works correctly.

The CORS hardening is sound (empty default = disabled, wildcard+credentials guard with warning, defense-in-depth), and the localhost bind default is a good security improvement.

One edge case to consider: the wildcard-with-credentials guard only fires when CORS_ORIGINS is exactly "*", not when "*" appears among a comma-separated list like "*,http://example.com". While unlikely, checking the parsed list instead of the raw string would make the guard more robust:

cors_allow_origins = _parse_csv(cors_origins_raw)
if "*" in cors_allow_origins:
    cors_allow_origins = ["*"]
    if cors_allow_credentials:
        logger.warning("...")
        cors_allow_credentials = False

This is a minor suggestion — the PR is solid as-is. LGTM.

Thanks @TheodorNEngoy — this is a solid security hardening contribution!

What was done

Rebased onto main (clean, no conflicts) and applied three fixes during review:

1. CORS wildcard bypass fix (High): The original guard (cors_origins_raw == "*") only caught the exact * string. Mixed inputs like *,https://example.com bypassed the safety check while Starlette still treated the list as allow-all. Fixed by checking "*" in cors_allow_origins on the parsed list, and normalizing any wildcard-containing list to ["*"].

2. LOG_LEVEL validation (Medium): LOG_LEVEL was passed to uvicorn without validation — invalid values like warn or " info " would crash at startup. Added strip/lowercase/validation against allowed uvicorn levels with a warning fallback.

3. Unused import (Low): Removed unused pytest import in test file.

Tests added

44 differential tests covering all new code:

• test_env_utils.py (32 tests): _env_bool, _env_int, _parse_csv — truthy/falsy/default/whitespace/edge cases
• test_cors_config.py (12 tests): CORS disabled by default, explicit origins, wildcard safety, mixed wildcard bypass (the new regression tests), edge cases

Verification

All pass:

• make doctest — 1193 passed
• make test — 12447 passed
• make pylint — 10.00/10
• make flake8 — clean