Possible security issue

[x-yzt]

Without allowed_hosts=False, the ALLOWED_HOSTS setting is set to ['*']. I don't really know how does Heroku handles routing, but I suspect this might be a security issue (see the docs https://docs.djangoproject.com/en/3.1/topics/security/#host-headers-virtual-hosting).

It seems your fork is the most up-to-date as the moment, so I though I'll open an issue.

[pkrefta]

Thanks for report. I'll take a look at this.