katachi-gen

The server uses standard practices for API key management (environment variables) and implements rate limiting in production. It processes user input for AI prompts and NFT metadata; input validation is present. The use of a server-side `MINTER_WALLET_PRIVATE_KEY` for NFT minting operations is a critical security consideration. This private key must be managed with extreme care in the deployment environment to prevent unauthorized access or misuse. `puppeteer-core` (or `playwright`) is used for thumbnail generation, loading local files, which is safer than external untrusted URLs. No direct `eval` or obvious command injection vulnerabilities were found.