mcp-playground

The project demonstrates strong security practices for a web application. It uses Node.js's `crypto` module for AES-256-GCM encryption of sensitive data like OAuth tokens and client secrets, with the encryption key securely loaded from environment variables and validated for correct format. Sensitive data in logs (headers like 'Authorization', 'Cookie', and body fields like 'password', 'token') are sanitized and redacted. Environment variables are strictly validated using Zod via `@t3-oss/env-nextjs`. Security headers are configured in `next.config.ts` to prevent common web vulnerabilities like XSS and clickjacking. PII is configured to be sent to Sentry, which is a conscious operator choice rather than a code vulnerability. The markdown rendering component likely uses `isomorphic-dompurify` for XSS protection.