Expense-Tracker-MCP-Server

The server employs strong security practices including bcrypt for password hashing, JWT-based authentication with token expiry, robust password strength validation, and environment variable loading for all sensitive credentials (e.g., SECRET_KEY, SMTP credentials, DATABASE_URL). All database interactions use parameterized queries via asyncpg, preventing SQL injection. User data is strictly isolated by filtering all queries with the authenticated user_id. Email verification is required for critical actions like account deletion and password resets, and there are attempt limits for verification/reset codes. The default SECRET_KEY provided in the code explicitly warns it should be changed in production.