Handler

The project handles authentication credentials (API keys, bearer tokens) and stores them in `~/.handler/sessions.json` on the local filesystem. While common for developer tools, this file is not encrypted, making stored credentials vulnerable if the user's home directory is compromised. The `handler server agent` component uses `subprocess.run` to interact with the `ollama` CLI, which is generally safe for its intended use cases (`ollama list`, `ollama pull`) but always carries a minor risk if arguments were less controlled. The `APIKeyAuthMiddleware` for the local A2A server uses `secrets.token_urlsafe` for generating API keys, which is good practice. Local servers (`handler server agent` and `handler server push`) bind to `0.0.0.0` or `127.0.0.1` by default; users should be aware of network exposure when binding to `0.0.0.0` without additional security measures, though the A2A agent supports API key authentication.