Fix bandit issues

README.md

@@ -24,6 +24,8 @@ SECRET_KEY=your_secret_key
 MONGO_URI=mongodb://localhost:27017/scouting_app
 TBA_AUTH_KEY=your_tba_api_key
 DEBUG=False
+HOST=localhost
+PORT=5000
 ```
 4. Make a virtual environment: `python -m venv venv`
   - To activate (type into command line):

app/__main__.py

@@ -8,4 +8,11 @@
 app = create_app()
 
 if __name__ == "__main__":
-    app.run(debug=True) if os.getenv("DEBUG") == "True" else serve(app, host="0.0.0.0", port=5000)
+    debug_mode = os.getenv("DEBUG", "False") == "True"
+    host = os.getenv("HOST", "127.0.0.1")
+    port = int(os.getenv("PORT", 5000))
+
+    if debug_mode:
+        app.run(debug=True, host=host, port=port)
+    else:
+        serve(app, host=host, port=port)

app/team/team_utils.py

@@ -70,7 +70,7 @@ def ensure_connected(self):
     def generate_join_code(self):
         """Generate a unique 6-character join code"""
         while True:
-            code = ''.join(random.choices(string.ascii_uppercase + string.digits, k=6))
+            code = ''.join(secrets.choice(string.ascii_uppercase + string.digits) for _ in range(6))
             if not self.db.teams.find_one({"team_join_code": code}):
                 return code