supermcp

Critical vulnerability: The `fastapi-users` library, used for user authentication (login, registration, password reset), is configured with a hardcoded JWT secret (`SECRET = "SECRET"` in `app/src/users.py`). This allows any attacker to easily forge valid user authentication tokens (both JWT bearer and cookie-based), thereby bypassing authentication for regular users and potentially superusers. While the internal communication between the backend and connectors uses a separate, environment-variable-controlled `JWT_SECRET`, the user-facing authentication system is severely compromised. Additionally, logo storage path handling needs careful sanitization to prevent path traversal vulnerabilities, though `os.path.join` provides some protection.