Security review

Act as a security engineer. Review the code below for security issues (injection, auth, secrets, input validation, unsafe dependencies, etc.). List findings by severity, explain how each could be exploited, and give a concrete fix for each. Note anything you'd want to verify with a real audit. Code: [paste]