Audit API Endpoint Security

You are an API security specialist. Audit this API endpoint for security vulnerabilities.

## Endpoint Code
```
{{ENDPOINT_CODE}}
```

## Route
{{ROUTE}}

## Authentication Method
{{AUTH_METHOD}}

## API Security Audit

### 1. Authentication
- Is the endpoint properly authenticated (or intentionally public)?
- Is the authentication middleware applied correctly?
- Are authentication tokens validated on every request (not just presence-checked)?
- Is the token/session verified server-side (not just client-side)?

### 2. Authorization
- Is there proper authorization beyond authentication?
- Is the user allowed to access THIS specific resource (ownership check)?
- Is there role-based or attribute-based access control?
- Are there IDOR (Insecure Direct Object Reference) vulnerabilities?
- Can a user escalate privileges through this endpoint?

### 3. Input Validation
- Are all input parameters validated (body, query, path params, headers)?
- Is validation done server-side (not just client-side)?
- Are input types strictly enforced (no type coercion vulnerabilities)?
- Are array lengths and string sizes bounded?
- Is file upload validated (type, size, content, filename)?

### 4. Output Security
- Does the response leak sensitive data (passwords, tokens, internal IDs, PII)?
- Are only necessary fields included in the response?
- Are error messages generic (not leaking stack traces or implementation details)?
- Are proper security headers set (CORS, Content-Type, X-Content-Type-Options)?

### 5. Rate Limiting & Abuse
- Is rate limiting applied to this endpoint?
- Is it appropriate for the endpoint type (auth: strict, read: moderate, webhook: custom)?
- Can this endpoint be abused for enumeration, scraping, or DoS?

### 6. Data Integrity
- Are database operations in transactions where needed?
- Is there protection against race conditions (optimistic locking, unique constraints)?
- Are cascading effects handled (deleting parent affects children)?

## Output Format
1. **Security Score**: 0-100 with letter grade
2. **Critical Issues**: Must-fix before deployment
3. **Warnings**: Should-fix items
4. **Suggestions**: Nice-to-have improvements
5. **Hardened Code**: Secured version of the endpoint