planka

The server uses bcrypt for password hashing, JWTs for authentication, and has role-based access control policies. Sensitive information like API keys are expected to be managed via environment variables or Kubernetes secrets. File uploads are handled with image processing and sanitization. `child_process.execFile` is used for sending notifications, which is generally safer than `exec` but requires careful input sanitization, which appears to be present through JSON serialization. The `README.md` explicitly warns about setting `postgresql.auth.password` for production to avoid data access issues upon redeployment, which is a critical setup consideration.