openotes

The server implements robust path validation in `src/core/paths.ts` to prevent common file system vulnerabilities such as path traversal (e.g., `..`), absolute path usage, null byte injection, and symlink escapes. All file operations are performed on paths that have been rigorously validated to ensure they remain within the defined vault root directory. Sensitive configurations like `VAULT_PATH` are loaded from environment variables (`.env`), avoiding hardcoded secrets. The `delete` tool requires explicit `confirm: true` argument, adding an essential safety confirmation step. Remote access is explicitly recommended via Cloudflare Tunnel and Cloudflare Access, providing a secure, authenticated layer that prevents direct exposure of the server to the public internet.