template-mcp-server

The application contains a hardcoded JWT secret ('super-secret-jwt-key-change-in-production') which is a critical vulnerability for production deployments. A generic HTTP endpoint (`/rpc/:rpcName`) exposes RPC functions marked as 'exposed' without authentication (`auth: false`), requiring careful management of which functions are exposed. Furthermore, an internal remote RPC queue worker (`pikku-remote-internal-rpc`) explicitly notes a 'security risk' as it allows invoking any internal RPC by name (`rpc.invoke`) without further validation, which could be exploited if an attacker can inject messages into this queue.