claude-context-system

CRITICAL VULNERABILITY: The PostgreSQL database password ('Snoboard19') is hardcoded directly in `mcp-server/src/index.ts`. Although a comment suggests using environment variables, the current implementation relies solely on this hardcoded value, making it vulnerable to exposure if the source code is compromised. Additionally, the `setup.sh` script also writes this hardcoded password into a `.env` file, which is then loaded by `backup-to-github.sh` and used for database operations, further increasing its exposure risk. RISK: Database backups are committed to a GitHub repository, potentially including sensitive information (e.g., credentials stored via `store_knowledge` tool, or detailed project/error logs). While the README recommends keeping the repository private, this is not enforced, and committing database dumps to a public repository would lead to significant data exposure. IMPROVEMENT: The `mcp-server/src/index.ts` should be updated to read database credentials from `process.env` variables instead of hardcoding them.