mendix-mcp-server

The project includes an obfuscated, hardcoded Pinecone API key in `src/vector/VectorStore.js` as a fallback if environment variables are not set. This is a critical security vulnerability as it could expose access to a shared Pinecone index. While `flyio-secrets.sh` indicates proper environment variable usage for deployment, a local run without explicit configuration would use the hardcoded key. The `SyncReminder` module uses `child_process.execSync` for git operations, which carries inherent risks if not carefully managed, although its current use for self-repo management appears controlled. Public REST and SSE endpoints lack user-level authentication, relying on rate-limiting for abuse prevention, which is noted as a future improvement in the `ARCHITECTURE.md`.