Rule-MCP-Server

The project demonstrates a strong commitment to security with features like RBAC (Public, User, Admin roles), API key authentication with bcrypt hashing and expiration, password policies (min length, complex characters), rate limiting, and audit logging. It enforces HTTPS for API key usage in production. It also implements CORS configuration. While `docker-compose.dev.yml` contains default database credentials for development, the documentation clearly states that strong, random `JWT_SECRET` and `ALLOWED_ORIGINS` are required for production, and database credentials should be configured via environment variables. Frontend stores authentication tokens in localStorage, which is a common practice but has XSS attack implications. No explicit 'eval' or obvious malicious patterns were found in the provided code.