- Fixed MutableHeaders bug- Disable API docs in production- CORS diagnostic endpoint- Security headers + CORS middlewareMust have ENVIRONMENT=production and CORS_ORIGINS=... in .env file

server.py

@@ -6340,8 +6340,9 @@ async def add_security_headers(request: Request, call_next):
     for header, value in security_headers.items():
         response.headers[header] = value
 
-    # Remove server identification headers
+    # Remove server identification headers (use del, not pop for MutableHeaders)
-    response.headers.pop("Server", None)
+    if "Server" in response.headers:
+        del response.headers["Server"]
 
     return response