djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket "handle_mount" and "ViewRuntime._build_request" rebuild an "HttpRequest" via "RequestFactory().get(...)" with no "HTTP_HOST", so "request.get_host()" defaulted to ""testserver"" on the live path. Host/subdomain/domain "TenantResolver"s then misresolved the tenant — "None" on the live path while the HTTP path resolved correctly. With "STRICT_MODE=False" the tenant-scoped managers returned unscoped rows (cross-tenant disclosure); with the default they returned an empty queryset (broken tenancy). This is fixed in djust 1.0.7. The handshake Host is extracted from the ASGI scope, validated against "ALLOWED_HOSTS" (the same logic as the CSWSH Origin gate, parsed with Django's "split_domain_port" so malformed Hosts are rejected at the boundary), and propagated — with the TLS scheme — into the reconstructed request, so live-path tenant resolution matches HTTP exactly. There is no known workaround on the live path short of upgrading. Users are most exposed when combined with "STRICT_MODE=False".