Will It Vibe?ALLOWED_HOSTS contains a wildcard
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A '*' entry in ALLOWED_HOSTS disables Django's Host header validation entirely, so the app will answer to any Host a client sends. That enables cache poisoning and can poison password-reset links that are built from request.get_host().
Why it matters
A '*' entry in ALLOWED_HOSTS turns off Django's Host header validation completely, so the app accepts requests for any hostname a client sends. That enables HTTP Host header attacks: cache poisoning when a CDN or proxy caches per-host, and poisoned password-reset or email-verification links when the app builds absolute URLs from request.get_host().
How to fix it
Replace the wildcard with the exact hostnames the app actually serves, read from an environment variable so each environment can list its own: ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "").split(","). For local development, list localhost/127.0.0.1 explicitly rather than falling back to a wildcard.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo