Security Review of Code

Perform a defensive security review of my own code in {{language}} ({{framework}}). It handles {{what_it_handles}}.

Code:
{{code}}

Check for: injection (SQL, command, template), broken authentication and authorization (including object-level access), insecure deserialization, secrets in code, unsafe file handling, SSRF, XSS and output encoding, CSRF, insecure defaults, dependency risks, logging of sensitive data, and rate limiting. For each finding give severity, the exact location, why it's exploitable, a fixed code snippet and a test that proves the fix. State what you couldn't assess without more context.