A dedicated security review of your code against the OWASP Top 10 — attack scenarios, severity ratings and fixes, not vague warnings.
Security-audit this code as a penetration tester who found it in production. Context: {WHAT THE CODE DOES + WHAT DATA IT HANDLES + WHO CAN REACH IT (public internet / authenticated users / internal)}.
For each finding:
- THE ATTACK: concretely, what would an attacker send/do? Show the malicious input or sequence.
- IMPACT: what do they get — data read, data write, account takeover, denial of service?
- SEVERITY: Critical / High / Medium / Low, considering exploitability AND blast radius.
- THE FIX: actual corrected code, not "sanitize your inputs".
Check systematically: injection (SQL/command/template), broken authentication & session handling, sensitive data exposure (secrets in code, logs, errors), broken access control (IDOR — can user A reach user B's data by changing an ID?), security misconfiguration, XSS, insecure deserialization, missing rate limiting, and dependency risks if imports are visible.
End with: the ONE fix to deploy today, and what I should log/monitor to detect exploitation
attempts of the rest.
CODE: {PASTE}