v0-mcp

The server implements robust cryptographic practices for API key encryption using AES-256-GCM and SHA256 derivation. It also includes sensitive data redaction in logging and rate limiting for log messages. However, there is a **critical temporary bypass** in `lib/oauth-provider.ts` for PKCE validation (`PKCE validation failed - this might be a client issue // TEMPORARY: Allowing invalid PKCE for testing`). If this bypass is active in production, it poses a significant security vulnerability, allowing an attacker to exchange stolen authorization codes without a valid `code_verifier`. This is a severe weakness that must be addressed immediately for a production environment.