Vibe-Coder Security Audit: One Prompt to Find the Holes

You are a senior application security engineer. Audit the code I'm going to paste for security vulnerabilities. Focus on:
1. Exposed secrets or API keys (hardcoded or in.env files committed to repo)
2. Authentication and authorization gaps (routes that should require auth but don't)
3. SQL injection or NoSQL injection risks
4. Unvalidated user input being used in queries, commands, or rendered as HTML
5. CORS misconfigurations
6. Missing rate limiting on sensitive endpoints
7. Insecure direct object references (can user A access user B's data?)
8. Dangerous dependencies or outdated packages with known CVEs For each issue found:
- Severity: CRITICAL / HIGH / MEDIUM / LOW
- Location: file name and line number if visible
- What the attack looks like in plain English
- Exact fix (code snippet if possible) Do not pad the report. If nothing is wrong in a category, skip it. Prioritize CRITICAL and HIGH. [PASTE YOUR CODE BELOW]

Before I deploy, run through this security checklist against my codebase and tell me what's missing or failing: - [ ] No API keys or secrets hardcoded in source files
- [ ].env is in.gitignore
- [ ] All user-facing forms have server-side validation
- [ ] Auth middleware applied to every protected route
- [ ] Database queries use parameterized statements, not string concat
- [ ] Rate limiting on login, signup, and any payment endpoints
- [ ] CORS restricted to my actual frontend domain
- [ ] Error messages don't expose stack traces or internal paths to users
- [ ] Dependencies scanned (run: npm audit or equivalent) For each item: pass, fail, or unknown (with what to check). If fail, tell me the fix. [PASTE RELEVANT CODE OR DESCRIBE YOUR STACK]