SchemaCrawler-AI

The HTTP transport profile in `application.yaml` explicitly allows all origins (`allowed-origin: '*'`), which is a Cross-Origin Resource Sharing (CORS) vulnerability for public APIs, though potentially intended for flexible AI agent integration. User-provided regular expressions for filtering database objects are directly used in `InclusionRule`s, posing a potential Regular Expression Denial of Service (ReDoS) risk if not adequately validated or sandboxed by the underlying SchemaCrawler library. Stack traces are logged to the client on exceptions (`logExceptionToClient`), which can lead to information disclosure. No hardcoded secrets or obvious command injection vulnerabilities were found. Database credentials are handled via environment variables.