# Security Review Lens

Review the provided code for **security vulnerabilities and risky patterns**.

## What to Look For

### Injection
- SQL queries built with string concatenation
- Shell commands with unsanitized input
- eval(), exec(), or dynamic code execution with user data
- Path traversal vulnerabilities (../ in file paths)

### Auth & Secrets
- Missing auth checks on sensitive endpoints
- Hardcoded credentials, API keys, or secrets
- Session tokens in URLs or logs
- Missing CSRF protection on state-changing operations

### Data Exposure
- Sensitive data in error messages or logs
- Overly permissive CORS or access controls
- Missing input validation on external data
- Unsafe deserialization of untrusted data

### Crypto Misuse
- Weak algorithms (MD5, SHA1 for security purposes)
- Hardcoded IVs or salts
- Predictable random for security tokens

## Output Format

For each finding:
```
[SECURITY] <severity:HIGH|MED|LOW> <file:line>
Vuln: <CWE or OWASP category if applicable>
Issue: <what's vulnerable>
Suggest: <parameterized query, sanitize input, use X library, etc.>
```

## Guidelines

- HIGH = exploitable vulnerability, fix before deploy
- MED = risky pattern, needs hardening
- LOW = defense-in-depth improvement
- Always suggest the secure alternative, not just "fix this"
- Consider the threat model (internal tool vs. public-facing)
- Reference OWASP Top 10 or CWE when applicable
