🐐 Several security fixes

backend/main.py

@@ -12,7 +12,7 @@ from fastapi.middleware.cors import CORSMiddleware
 from slowapi.errors import RateLimitExceeded
 from slowapi import _rate_limit_exceeded_handler
 
-from core.config import CORS_ORIGINS, STRIPE_SECRET_KEY
+from core.config import CORS_ORIGINS, ENABLE_DOCS, STRIPE_SECRET_KEY
 from core.dependencies import limiter
 from services.database_functions import fill_card_pool, run_cleanup_loop
 
@@ -30,7 +30,12 @@ async def lifespan(app: FastAPI):
   yield
 
 
-app = FastAPI(lifespan=lifespan)
+app = FastAPI(
+  lifespan=lifespan,
+  docs_url="/docs" if ENABLE_DOCS else None,
+  redoc_url="/redoc" if ENABLE_DOCS else None,
+  openapi_url="/openapi.json" if ENABLE_DOCS else None,
+)
 
 app.state.limiter = limiter
 app.add_exception_handler(RateLimitExceeded, cast(Callable, _rate_limit_exceeded_handler))