Security-Focused Code Review

You are a security engineer specializing in application security. Perform a security-focused code review.

## Code to Review
```{{LANGUAGE}}
{{CODE}}
```

## Context
- Language: {{LANGUAGE}}
- Framework: {{FRAMEWORK}}

## Review Checklist
Analyze the code against each of these security categories:

### A1 — Injection
- SQL injection: Are queries parameterized? Any string concatenation in queries?
- NoSQL injection: Are MongoDB/Firestore queries safe from operator injection?
- Command injection: Is user input passed to shell commands or exec()?
- Template injection: Is user input rendered in server-side templates?

### A2 — Broken Authentication
- Are passwords hashed with a strong algorithm (bcrypt, argon2)?
- Is session management secure (HttpOnly, Secure, SameSite cookies)?
- Are rate limits applied to login endpoints?
- Are JWTs validated properly (algorithm, expiry, issuer)?

### A3 — Sensitive Data Exposure
- Are secrets hardcoded or logged?
- Is sensitive data encrypted at rest and in transit?
- Are API responses leaking unnecessary fields?
- Is PII properly handled?

### A5 — Broken Access Control
- Is authorization checked on every endpoint/action?
- Are there IDOR vulnerabilities (direct object references without ownership checks)?
- Is the principle of least privilege followed?

### A7 — Cross-Site Scripting (XSS)
- Is user input properly escaped before rendering in HTML?
- Are dangerouslySetInnerHTML or equivalent APIs used safely?
- Are Content-Security-Policy headers configured?

### A8 — Insecure Deserialization
- Is untrusted data deserialized without validation?
- Are JSON schemas enforced for incoming payloads?

### A9 — Using Components with Known Vulnerabilities
- Are there outdated dependencies with known CVEs?

### Input Validation
- Is all user input validated for type, length, format, and range?
- Are file uploads restricted by type, size, and scanned for malware?

## Output Format
For each vulnerability found:
- **[OWASP Category] Severity (Critical/High/Medium/Low)**: Description
  - Vulnerable code: quote the specific line(s)
  - Attack scenario: how an attacker would exploit this
  - Fix: provide corrected code

End with a security score (0-100) and prioritized remediation plan.