Has little or no server side validation? (form prompts for min 1), I shared https://pass.sh/show/2582dbae-5450-4a74-a758-152cdac1c049 with delete after -1 views (simple inspect and edit). It does work to some extent tho as I the link comes up empty. :)
Had a look at the code, no validation other than on the client. Sidenote, forgot how clean, minimal and expressive Python can be, was a pleasure to quickly grok.