Security pass on this change

Anything touching auth, user input, file paths, or the database.

Review the code below for security problems only. Ignore style and performance.

Check specifically:
- Injection: SQL, command, template, path traversal
- Authentication and authorisation: missing checks, checks that can be bypassed, IDOR
- Input validation and its absence at trust boundaries
- Secrets: hardcoded, logged, or sent where they shouldn't go
- Data exposure: over-fetching, verbose errors, leaking internals to the client
- Dependencies and version pins, if visible

For each finding: the exact line, how it would be exploited concretely, and the fix. Rate severity. If you find nothing, say so rather than padding.

Code:

Reviewing a change. Passes you run over a diff before it merges: correctness, security, concurrency, migrations.