mineru-tianshu

The project implements robust JWT and API Key authentication with role-based access control. The `JWT_SECRET_KEY` is correctly parameterized for production, avoiding hardcoded secrets. However, `RUSTFS_ACCESS_KEY` and `RUSTFS_SECRET_KEY` have insecure default values (`rustfsadmin`) in `docker-compose.yml`, which must be explicitly overridden in the `.env` file for production deployments. File uploads via the MCP server (Base64 or URL) are first saved to temporary files before internal API submission, a generally safe practice. Command execution through `subprocess.run` (e.g., `ffmpeg`) appears to use fixed commands with internal file paths, mitigating command injection risks. Ensure `ALLOWED_ORIGINS` is restricted in production.