Hardened dual-header auth and fixed deployment scope for HF Space

app.py

@@ -63,9 +63,10 @@ def require_auth(f):
         
         auth = request.headers.get("Authorization")
         secret = request.headers.get("X-Secret-Token")
-        token = secret or (auth.split(" ")[1] if auth and auth.startswith("Bearer ") else None)
+        bearer = auth.split(" ")[1] if auth and auth.startswith("Bearer ") else None
         
-        if not token or token != SECRET_TOKEN:
+        # Enforce dual-header authentication for strict internal security
+        if bearer != SECRET_TOKEN or secret != SECRET_TOKEN:
             raise HTTPException(status_code=401, detail="Unauthorized")
         return await f(*args, **kwargs)
     return decorated