paylo-mcp-server

The server uses Supabase ORM for database interactions, which generally provides protection against SQL injection. However, specific `ilike` usage with template literals in `ProductService.searchProducts` (e.g., `ilike('name', %${query}%)`) should be confirmed for complete sanitization against potential payload manipulation. The server logs verbose error messages and stack traces to `console.error`, which could expose internal file paths or system details to consumers of the MCP server. Hardcoded default public Supabase keys are provided in `src/services/supabase.ts` if environment variables are not set, which is convenient for quick starts but not ideal for production security practices as it might bypass explicit permission configurations.