claude-mermaid

The server implements strong security practices including Content Security Policy (CSP) headers for web previews and robust path validation (`validateSavePath`, `validatePreviewId`) to prevent path traversal attacks when saving or accessing diagrams. `execFile` is used for rendering diagrams via `mermaid-cli`, which is generally safer than `exec`. Input parameters for `mermaid-cli` are sanitized or enum-restricted, mitigating command injection risks. No hardcoded secrets or obvious malicious patterns were found. The primary attack surface is through the `mermaid-cli` itself and the interpretation of diagram code, which is an inherent risk when rendering user-provided code, but not directly attributable to server vulnerabilities.