db-explorer

The application uses Zod for validation, JWT for authentication, and Helmet for basic Express security. However, a critical SQL injection vulnerability exists in the `select_data` tool within the `/api/chat` route, where the `where` clause is constructed by direct string concatenation without proper parameterization. The `execute_custom_query` tool, which allows arbitrary SQL execution, also poses a high risk if the underlying database connector's `query` method does not adequately protect against injection for raw SQL statements. Storing tokens in local/session storage makes them vulnerable to XSS attacks. These issues significantly lower the security score, making the application potentially unsafe for sensitive data or untrusted users.