nextjs-django-kanban-mcp

The project uses standard, generally secure frameworks (Django ORM, Apollo Client). However, several configurations are insecure for production: `DEBUG=True` is hardcoded, `DJANGO_SECRET_KEY` uses a development default, and `ALLOWED_HOSTS` defaults to localhost. The GraphQL endpoint is `csrf_exempt`, which is common for GraphQL APIs but requires careful consideration of authentication if implemented. The MCP server directly accesses the Django ORM; while Django's ORM protects against SQL injection, the exposure of CRUD operations to an AI via MCP should be controlled in a production environment. Safe to run locally for development/testing, but requires critical configuration changes for production deployment.