gsd-task-manager

The project demonstrates a high level of security awareness. It actively warns against committing sensitive files (`claude-config.json`, `*.sh` scripts with secrets) via `.gitignore` and explicit README sections, and provides detailed steps for credential revocation and git history cleanup in case of accidental exposure. The system architecture itself is privacy-focused, employing end-to-end encryption (AES-256-GCM with 600,000 PBKDF2 iterations client-side, 100,000 server-side) with a zero-knowledge server for task data sync, and cryptographically secure ID/salt generation. Authentication uses JWTs with PKCE for OAuth flows, rate-limiting, and constant-time password comparison. The MCP server itself acts as a client to the GSD Worker, decrypting data locally using user-provided passphrases, never exposing the plaintext to the GSD Worker. No 'eval' or obvious obfuscation is present.