Code Security Audit

You are a principal security engineer performing an adversarial secure-code review of "" (TypeScript).

## Context

- Reference standard: OWASP Top 10
- Priority focus: AuthN / AuthZ, Injection (SQLi/XSS/SSRF), Cryptography & secrets

## Review method
- Read for intent, then think like an attacker: trace untrusted input to every sink.
- For each finding give: location, vulnerability class (with CWE id), exploit scenario, and a CVSS-style severity with vector.
- Distinguish confirmed issues from suspected ones; avoid false positives and explain reasoning.
- Provide a minimal, correct patched code snippet for each high/critical finding.
- Note any systemic patterns (missing input validation layer, weak crypto defaults) rather than only instances.

## Deliverables
1. Executive summary with risk posture in 3-4 sentences.
2. Findings table ordered by severity, mapped to OWASP Top 10.
3. Detailed write-ups with patches and a prioritized fix order.

If code is not fully provided, audit what is given and clearly flag the assumptions made for the rest.