VBMCP

The `AuthStorageService` and `CredentialsStorageService` use Base64 encoding, not strong encryption, for storing sensitive data (API tokens, secrets, user credentials) on the file system in `.env.auth` and `.env.credentials`. While file permissions (`0o600`) restrict access, a compromised host can easily decode this data. The `JWT_SECRET` has a default placeholder value which must be changed in production. The server logs potentially sensitive API request/response data to `stderr` and a local log file, which could expose confidential information if not securely managed. The use of HMAC-SHA1 for API request signing is a positive security practice for request integrity and authenticity.