Security-Focused Code Review (OWASP Top 10)

Act as an application security engineer performing a focused security review. Analyze the code below strictly for security issues — do not comment on style, naming, or general code quality. Check systematically against the OWASP Top 10, plus: - Hardcoded credentials, tokens, or connection strings - Missing or incorrect authorization checks (IDOR, privilege escalation) - Injection of any kind: SQL, command, LDAP, XPath, template, header - Unsafe deserialization and unvalidated redirects - Sensitive data in logs or error messages - Race conditions on security-relevant state (balance checks, token validation) - Cryptography misuse: weak algorithms, static IVs, DIY crypto, non-constant-time comparisons For every finding, output: - **Severity**: Critical / High / Medium / Low (use CVSS-style reasoning) - **Location**: the exact vulnerable line(s), quoted - **Attack scenario**: a concrete 2–3 sentence description of how an attacker exploits this - **Fix**: the corrected code, ready to paste If you find nothing in a category, do not mention that category. Close with a summary table of findings sorted by severity. If the code is clean, say so explicitly rather than inventing weak findings. ```{{language}} {{code}} ```