lead-ai-mcp

CRITICAL: A default 'admin' user is created with password 'admin123' if no users exist. This password must be changed immediately after initial setup to prevent unauthorized access. API keys and secrets are loaded from environment variables, which is good practice, but the system relies on the secure configuration and protection of these keys. The 'ops_pm2_logs' tool uses 'child_process.execAsync' with user-provided input ('process' name), which could pose a command injection risk if not sufficiently sanitized by the underlying 'pm2' CLI. Scraper credentials are encrypted on disk using a key derived from an environment variable ('SCRAPER_SECRET') and the hostname, which is an improvement over plaintext storage but remains a sensitive data point.