travel_agent

Critical security vulnerabilities found. The `AMAP_MAPS_API_KEY` is hardcoded in `backend/app/agents/trip_planner_agent.py` and `backend/app/services/amap_service.py`, which is a severe information leak. The CORS configuration in `backend/app/api/main.py` is overly permissive with `allow_origins=... + ['*']`, making it vulnerable to various cross-origin attacks in a production environment. Default sensitive values like `jwt_secret_key`, `mysql_password`, and `redis_password` are present in `config.py`, posing a risk if not explicitly overridden by environment variables. File upload handling includes basic type and size validation but a thorough review for more complex bypasses (e.g., polyglot files) would be prudent. The application uses ORM for database interactions, which generally protects against SQL/NoSQL injection, but overall security is significantly compromised by hardcoded keys and permissive CORS.