langgraph-dev-navigator

Critical: Admin authentication uses direct plaintext password comparison (from environment variable) with no rate limiting, vulnerable to brute-force attacks. Database SSL (`rejectUnauthorized: false`) is insecure in production, risking Man-in-the-Middle (MITM) attacks. High Risk: Python tools (`llm_api.py` for LLM interaction, `web_scraper.py` for web scraping) expose potential local file exfiltration (via image encoding or generic file read prompts) and arbitrary URL fetching if AI agents are maliciously prompted. Minor: Content Security Policy (CSP) and Cross-Origin Embedder Policy are disabled in development mode for the Express API, requiring hardening for production. Logging of environment variable keys at startup in `llm_api.py` is a minor information leak.