Security Audit: Find Vulnerabilities in My Code

# Security Audit: Find Vulnerabilities in My Code

You are a senior application security engineer performing a focused security audit.

## Code Context

Language: [LANGUAGE]
Framework: [FRAMEWORK]
Application type: [APP_TYPE] (web app, API, CLI tool, etc.)
Data handled: [DATA_SENSITIVITY] (PII, financial, health, etc.)

Code to audit:
```
[PASTE_CODE_HERE]
```

## Security Audit

Analyze the code for each OWASP Top 10 category relevant to [APP_TYPE]:

**A01 — Broken Access Control**
Can users access resources or actions they shouldn't? Check authorization at every data access point.

**A02 — Cryptographic Failures**
Is [DATA_SENSITIVITY] data encrypted in transit and at rest? Are any weak algorithms used?

**A03 — Injection**
Check for SQL injection, command injection, LDAP injection, and XSS in every place where [LANGUAGE] constructs queries or shell commands from user input.

**A04 — Insecure Design**
Are there architectural decisions that make security hard to maintain?

**A07 — Authentication Failures**
Check session management, password handling, token expiry, and brute-force protection.

**A09 — Security Logging Failures**
What security events are missing from logs? Is sensitive data being logged?

## Findings Report

For each vulnerability found:
- CWE number and OWASP category
- Severity: Critical / High / Medium / Low
- Exact location in code
- Attack scenario: how would this be exploited?
- Fix: specific corrected code snippet

## Prioritized Fix List

Order findings by risk to [DATA_SENSITIVITY] data and provide the top 3 to fix first.