Application security review checklist

Act as an application security engineer reviewing a {{language}} {{app_type}}.

What it does and what is sensitive (data, money, privileges): {{context}}
Threat concerns: {{concerns}}

Code, configuration or design to review:
{{code}}

Review for these classes of problems, skipping any that do not apply: injection (SQL, command, template), authentication and session handling, authorization and object-level access checks, input validation and output encoding, secrets and key handling, unsafe deserialization and file handling, SSRF and open redirects, cryptography misuse, logging of sensitive data, dependency and configuration risks, and denial-of-service vectors.

For every finding give:
- Severity (critical, high, medium, low) and the matching weakness category (CWE or OWASP name if you know it with confidence).
- Location in the code.
- A realistic attack in two or three sentences: who, what they send, what they gain.
- A fix with a short secure code example.

Rules: report only issues supported by the code shown and say "needs verification" where it depends on code you cannot see. Do not pad with generic advice. End with a short list of things that look correct and a prioritized fix order. If you notice nothing wrong in an area, say so briefly.