OWASP Top 10 Security Audit

Security-audit the code below. You are looking for exploitable vulnerabilities, not style issues: every finding needs an attack story.

Code (routes/handlers, auth logic, DB access, file handling: the attack surface):
"""
[PASTE CODE, or point an agent at the repo and name the entry points]
"""

Context: [STACK + WHERE THIS RUNS, e.g. "Express API, public internet, JWT auth" / "internal Django admin"]
What's sensitive here: [THE DATA/ACTIONS AN ATTACKER WOULD WANT: PII, payments, admin functions]

Audit systematically against each class, reporting only what applies:
1. **Injection**: SQL/NoSQL built by string concatenation, shell commands from user input, unsanitized HTML (XSS), template injection. Parameterization present everywhere?
2. **Broken auth & session**: password handling, token generation/expiry/storage, session fixation, missing rate limits on login/reset endpoints.
3. **Broken access control**: the highest-yield class: endpoints missing authorization (not just authentication), IDOR (can user A fetch /orders/123 belonging to user B?: check EVERY id-taking route), privilege checks done client-side only, mass assignment.
4. **Sensitive data exposure**: secrets in code/config/logs, PII in error messages or URLs, missing encryption where the context demands it.
5. **Security misconfiguration**: permissive CORS, missing security headers, debug modes, default credentials, verbose stack traces to clients.
6. **SSRF & unsafe deserialization**: user-supplied URLs fetched server-side, pickle/eval/yaml.load on external input.
7. **Vulnerable dependencies**: flag imports with known-vulnerable patterns; recommend a lockfile audit command for my stack.

For each finding:
- **Severity** (critical / high / medium / low) ranked by exploitability × impact on my stated sensitive assets, not theoretical purity.
- **Location**: file:line.
- **Attack scenario**: the concrete steps an attacker takes, with an example payload where safe to show.
- **Fix**: the minimal code change, written out, plus the pattern that prevents the class ("parameterize everywhere", not just this instance).

Rules: only report findings you can defend with an attack path, a hypothetical without a route to exploitation is a note, not a finding (put those in a short "hardening suggestions" list at the end). If an area looks clean, say what you checked and found sound. End with the top 3 fixes by risk-reduction-per-hour.