[spec] apps/go-rastrillo/internal/todo/origin.go:28: Delegating to csrf.Protect lets Sec-Fetch-Site: same-origin or none override a foreign Origin. Such POSTs execute instead of returning the required 403. Compare the supplied Origin directly with the configured origin.
[correctness] apps/go-rastrillo/internal/todo/handlers.go:79: Form parsing errors are ignored. An edit body exceeding the 1 MiB limit yields an empty title, so the existing todo is deleted and the response reports success. Reject parsing errors before changing data.
[correctness] apps/go-rastrillo/internal/todo/static/app.js:36: An add response discards the current input unconditionally. Submit a todo, then type a replacement title while the request is pending: the response erases that new text. Clear the submitted value when submitting and preserve subsequent typing.
[spec] apps/go-rastrillo/cmd/todo/main.go:42: Explicit listen addresses are never restricted to loopback. --listen 0.0.0.0:8080 passes through to Rastrillo’s TCP listener and exposes the app on every interface, contrary to the brief. Reject addresses whose host is not 127.0.0.1.
amadan