ExpoSnap

The HTTP server uses a wide-open CORS policy (`Access-Control-Allow-Origin: *`), which is convenient for local development but poses a security risk in a production environment by allowing any domain to interact with it. File uploads are handled using `multer` and are saved to an internally managed directory with internally generated filenames, mitigating common path traversal vulnerabilities. No explicit 'eval' or direct command injection vectors with unsanitized user input were found. The auto-discovery feature actively scans local IP ranges, which could lead to unintended exposure on less controlled networks, though the server still requires specific endpoints to be hit.