fix(security): web server hardening, easyRadiology SSRF guard, offline provider stub

[Liohtml]

Prioritised batch addressing the three open High-severity issues found by the repo-monitor/repo-health sweeps.

Closes

• Closes [repo-monitor] High: Web server binds 0.0.0.0 with no authentication — exposes medical imaging data #26 — web server binds 0.0.0.0 with no authentication
• Closes [repo-monitor] High: SSRF via unvalidated linkToERI URL fetched from portal API response #28 — SSRF via unvalidated linkToERI download URL
• Closes [repo-health] High: "local" LLM provider in FALLBACK_ORDER is not implemented — offline mode raises RuntimeError #36 — "local" LLM fallback is unimplemented and crashes offline runs

Changes

#26 — Web server hardening

• Default bind host changed from 0.0.0.0 → 127.0.0.1 (CLI serve + Settings). Network exposure is now an explicit opt-in.
• Optional API-key auth: when MEDCHECK_API_KEY is set, /api endpoints require a matching X-API-Key header (constant-time compare). /health and / stay public. With no key configured, behaviour is unchanged (localhost dev).
• serve prints a warning when binding to a non-loopback host without a key.

#28 — easyRadiology SSRF guard

• New _validate_download_url(): requires https and a host on the easyradiology.net/.de allowlist before fetching the exam ZIP.
• Disabled follow_redirects on the download client so a 30x bounce can't escape the allowlist (e.g. to 169.254.169.254 or RFC 1918).

#36 — Offline provider stub

• New LocalLLMProvider (llm/local.py): check_available() returns False so the router skips it cleanly; analyze_images() raises an actionable NotImplementedError pointing to Add local LLaVA-Med vision model provider #18.
• Registered in the vision router and surfaced in medcheck models. No more RuntimeError: No LLM provider available when running with zero API keys.
• README / .env.example mark local/LLaVA-Med as coming soon (Add local LLaVA-Med vision model provider #18).

Validation

• ruff check ✅ · ruff format --check ✅ · mypy ✅ · bandit -ll ✅
• Test suite: 89 passed (was 73; +16 covering URL validation, API-key auth, default host, and the local provider)
• Coverage 66%

Note: development is constrained to the claude/repo-issues-features-3ZLdb branch, so these three independent fixes are bundled into a single PR.

https://claude.ai/code/session_01KYcUxCGAHaTPrRHTzJCWQz

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

@Liohtml, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 1 minute and 27 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 763941fc-8949-4431-af5b-74c5482d74bf

📥 Commits

Reviewing files that changed from the base of the PR and between c44fdf9 and 4c81bbc.

📒 Files selected for processing (13)

• .env.example
• CHANGELOG.md
• README.md
• src/medcheck/core/config.py
• src/medcheck/llm/local.py
• src/medcheck/main.py
• src/medcheck/pipeline/vision_analysis.py
• src/medcheck/providers/easyradiology.py
• src/medcheck/web/app.py
• tests/unit/test_core/test_config.py
• tests/unit/test_llm/test_local.py
• tests/unit/test_providers/test_easyradiology.py
• tests/unit/test_web.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/repo-issues-features-3ZLdb

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

❌ Patch coverage is 85.41667% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/medcheck/main.py	40.00%	3 Missing ⚠️
src/medcheck/pipeline/vision_analysis.py	0.00%	2 Missing ⚠️
src/medcheck/providers/easyradiology.py	81.81%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!