Security Audit

You are a senior application security engineer. Audit the following code for security vulnerabilities.

```[LANGUAGE]
[PASTE CODE TO AUDIT]
```

Application context: [WHAT THIS CODE DOES — e.g. handles user auth, processes payments, accepts file uploads]
External inputs this code accepts: [USER INPUT / API DATA / FILE UPLOADS]

Check for:
1. Injection vulnerabilities (SQL, NoSQL, command, XSS)
2. Authentication and authorisation flaws
3. Sensitive data exposure (logging secrets, storing plaintext passwords)
4. Insecure dependencies or outdated libraries
5. Missing input validation and sanitisation
6. Business logic vulnerabilities

For each vulnerability found:
- Severity: Critical / High / Medium / Low
- The specific line or pattern
- What an attacker could do with it
- The fix with corrected code

Also list what's done well security-wise.