movieRecsBot

The server uses named parameters for most SQL queries, which is a good practice against SQL injection. Sensitive administrative endpoints are protected by an `X-Bootstrap-Token`. Docker secrets are utilized for the Telegram bot token (though not directly for this MCP server, it's a monorepo setup). However, default placeholder values like `change-me` for `APP_ADMIN_BOOTSTRAP_TOKEN` and `SPRING_DATASOURCE_PASSWORD` are present; these must be explicitly changed in production environments. There is a minor risk with direct string concatenation for `hnsw.ef_search` and `maxTitles` in SQL queries, although these values are currently derived from application configuration properties, not directly from untrusted user input.