simple_local_rag

The system uses `os.getenv` for API keys and recommends storing them in a `.env` file excluded from version control, which is good practice. File uploads are handled with temporary files and explicit `.pdf` extension checks, reducing direct path traversal risks. The `VectorStore` uses `pickle.dump` and `pickle.load` for chunk metadata. While typically used for internal data, if an attacker could tamper with the `chunks.pkl` file, this could lead to a deserialization vulnerability. For a 'local' RAG system, this risk is mitigated by assuming trusted local file access. The FastAPI backend uses `allow_origins=["*"]` for CORS, which is noted as acceptable for local development but a security risk for production deployments.