Agentic-Travel-Planner

The application uses environment variables for API keys, avoiding hardcoding secrets. Network communication with external APIs (Amadeus, Open-Meteo, Stripe) utilizes httpx with status checks and timeouts. Stripe payment processing correctly uses idempotency keys and keeps the secret key server-side. File uploads are handled with server-side text extraction for documents (PDF, DOCX, TXT), which is safer, and passes raw binary for images to the LLM. However, the FastAPI CORS middleware is configured with `allow_origins=['*']` which is a significant security risk in production environments as it allows cross-origin requests from any domain. Additionally, the Google LLM provider explicitly disables all content safety settings (`BLOCK_NONE`), which could allow unfiltered harmful content to pass through the agent.