plc-gateway

The server uses `allow_origins=["*"]` for CORS, which is a significant security risk in production environments as it allows cross-origin requests from any domain. There is no visible built-in authentication or authorization for API access, which is critical for an API interacting with industrial control systems. The `--production` flag binds the API to `0.0.0.0`, making it publicly accessible, which, when combined with the lack of authentication and permissive CORS, creates a major vulnerability. Dynamic PLC IP/port specification in API requests (`plc_host` parameter) increases flexibility but also expands the attack surface if not securely deployed. The `_read_plc` and `_batch_read_plc` functions establish and close a new PLC connection for each API request, which could be an efficiency concern under high load but is not a security flaw.