air

The project uses environment variables for sensitive configurations (e.g., database URLs, JWT secrets, API keys) which is good practice. The use of `os.exec.Command` and direct SQL query execution (`db.query`, `db.shell`) is present, but primarily within developer tools and testing infrastructure, where such operations are expected and justified. LLM integrations use tool-calling with structured schemas, which mitigates arbitrary code injection via natural language input. Local Docker Compose configurations use default 'test' credentials, which should not be used in production. Network services in local dev are exposed to 0.0.0.0, requiring users to secure production deployments appropriately.