copilot-security-instructions

The server demonstrates a strong intent for security by focusing on secure coding practices and using `zod` for input schema validation (e.g., prompt names). However, there are critical security concerns regarding default configurations and logging practices: 1) The `reqInfo` middleware captures the entire `req.body` for all requests to `/mcp` POST endpoint, which is then logged by default via `logger.info`. If sensitive data is included in JSON-RPC requests, this could lead to information leakage. 2) The `.env.example` file specifies a default `server.ssl.pfx.passphrase` of 'PFX_PASSPHRASE' and default AMQP credentials ('guest'/'guest'). Using these defaults in a production environment would be a severe security vulnerability. While the documentation notes these need customization, they represent insecure-by-default settings.