priority-forge

CORS is configured to allow '*' (any origin), which is generally insecure for publicly exposed applications but common for local development. Data is stored in plain JSON files on the local filesystem, which might be a concern for highly sensitive data or multi-user environments without proper filesystem permissions. Input validation is present in routes and MCP tool handlers for required fields and enum values, but extensive sanitization against injection attacks (e.g., in notes fields) is not explicitly implemented. Given its local, single-user context, these risks are mitigated for its intended use.