Document that server_py binds to loopback and serves unauthenticated, that loopback binding is the trust boundary, and how to report vulnerabilities privately via GitHub Security Advisories. Only the latest release is supported.
