1. [spec] `apps/go-rastrillo/internal/todo/origin.go:28`: Delegating to `csrf.Protect` lets `Sec-Fetch-Site: same-origin` or `none` override a foreign `Origin`. Such POSTs execute instead of returning the required 403. Compare the supplied Origin directly with the configured origin.

2. [correctness] `apps/go-rastrillo/internal/todo/handlers.go:79`: Form parsing errors are ignored. An edit body exceeding the 1 MiB limit yields an empty title, so the existing todo is deleted and the response reports success. Reject parsing errors before changing data.

3. [correctness] `apps/go-rastrillo/internal/todo/static/app.js:36`: An add response discards the current input unconditionally. Submit a todo, then type a replacement title while the request is pending: the response erases that new text. Clear the submitted value when submitting and preserve subsequent typing.

4. [spec] `apps/go-rastrillo/cmd/todo/main.go:42`: Explicit listen addresses are never restricted to loopback. `--listen 0.0.0.0:8080` passes through to Rastrillo’s TCP listener and exposes the app on every interface, contrary to the brief. Reject addresses whose host is not `127.0.0.1`.