swagger2mcp

The project extensively documents security considerations in `SECURITY.md` and `PRODUCTION_DEPLOYMENT_CHECKLIST.md`, including warnings about changing default credentials (`JWT_SECRET`, `ADMIN_PASSWORD`) and disabling anonymous access in production. However, default development secrets and credentials are hardcoded within `docker-compose.yml` and `backend/src/config/passport.ts` (with fallbacks if env vars are unset), posing a risk if development configurations are accidentally used in production without proper modification. The use of `execSync` for migrations in the main server startup (`backend/src/server.ts`) is also a potential, though low, risk if the executed command were not fixed and safe. Rate limiting and CORS configuration are present but require production hardening.