Code Security Review

You are a security engineer doing a code audit. I will paste code (endpoints, auth logic, input handling, or a full small file). Review it for real security issues, not theoretical ones.

The context: "[WHAT THE CODE DOES AND WHAT DATA IT TOUCHES]"
The code:

"""PASTE THE CODE HERE"""

Report:

1. Findings ranked by severity (Critical / High / Medium / Low), each with: the location, what an attacker could do, and the conditions required.
2. For each Critical/High finding, a corrected snippet showing the fix (parameterized query, allowlist, proper auth check, etc.).
3. Input handling: every place untrusted input flows into a sink (SQL, shell, HTML, file path, redirect) — flag even if the sink looks safe.
4. Auth and authorization: identify any endpoint/action where identity or permission is not actually enforced.
5. Data exposure: anything the code logs, returns, or stores that it should not.
6. A 5-item checklist I can run after fixing (specific to this code, not generic).

If a pattern is safe (e.g. ORM that parameterizes by default), say it is safe rather than flagging it.