Aug 26 - Enhance security 2

app/__init__.py

@@ -42,7 +42,14 @@ def create_app(config_name: str = 'development') -> Flask:
     # IP keys spoof-resistant — a client cannot bypass per-IP limits by injecting
     # an arbitrary IP into the XFF header.
     app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1)
-    app.config.from_object(config[config_name])
+    selected_config = config[config_name]
+    # Reject insecure production settings before the app is handed back, so no
+    # request is ever served under one. Deliberately not done at class-definition
+    # time — that made importing app.config impossible without production
+    # secrets, breaking tests and local tooling.
+    if hasattr(selected_config, 'validate'):
+        selected_config.validate()
+    app.config.from_object(selected_config)
 
     # Extensions
     db.init_app(app)
@@ -230,7 +237,9 @@ def create_app(config_name: str = 'development') -> Flask:
         # WERKZEUG_RUN_MAIN == 'true' only in the child (the actual server),
         # so we skip the scheduler in the parent reloader to avoid duplicate jobs.
         import os
-        if not app.debug or os.environ.get('WERKZEUG_RUN_MAIN') == 'true':
+        if app.config.get('SCHEDULER_ENABLED', True) and (
+            not app.debug or os.environ.get('WERKZEUG_RUN_MAIN') == 'true'
+        ):
             scheduler.start()
 
     # ── Production safety checks ───────────────────────────────────────────────