savecontext

The server handles API keys, potentially sensitive context data, and executes OS commands (git, browser opening). API keys are designed to be shown once and stored with 0o600 permissions in `~/.savecontext/credentials.json`. Browser opening is restricted to `savecontext.dev` domains. Input validation is present for tool arguments. The `key_pattern` feature for tagging uses regex construction, which, if not carefully sanitized beyond current checks, could theoretically lead to ReDoS, though its internal application to context item keys and existing length limits mitigate this risk. Overall, it follows reasonable security practices for its domain, but users should be mindful of API key handling and the nature of sharing data with a cloud service (if cloud mode is enabled).