PDFlow

The project demonstrates a strong focus on security. Explicit path validation functions (`isValidPathComponent`, `getSecureFilePath`) are implemented to prevent directory traversal in API routes. The `child_process.spawn` method is used over `exec` with arguments passed as an array to prevent command injection when executing shell scripts. API keys are managed client-side in `sessionStorage` or via environment variables, not hardcoded. Docker configuration uses a non-root user (`nextjs:nodejs`), `read_only: true` for the filesystem (with exceptions for necessary write directories), `no-new-privileges:true`, and resource limits, adhering to robust container security practices. The MCP server also implements file path validation against a configurable list of `ALLOWED_DIRECTORIES`.