shinzo

The database setup instructions in `db/README.md` are critically insecure for any production environment, recommending exposing PostgreSQL publicly (`0.0.0.0/0`) with MD5 passwords. The application's Fastify server enables Cross-Origin Resource Sharing (`CORS`) with `origin: true`, allowing requests from any origin, which is overly permissive for most production setups. Developers explicitly flag default `JWT_SECRET` and `ENCRYPTION_KEY` values in `backend/src/config.ts` and `backend/src/utils.ts` as insecure for production. While the codebase uses parameterized SQL queries to prevent injection, the reliance on a single, environment-provided `ENCRYPTION_KEY` means compromise of the server's environment would expose all stored provider keys. JWTs are used for user sessions, which are valid for 24 hours without an explicit server-side invalidation mechanism.