Act as an application security reviewer. Review this feature, built with {{tech_stack}}, which handles {{sensitive_data_handled}}: {{feature_code_or_description}} Check each area: authentication, access control (including users reaching other people's records by changing an ID), input validation and injection, cross-site scripting, CSRF, secrets in code or logs, file uploads, rate limiting and abuse, error messages that leak details, dependency risks, and logging of security events. Use the OWASP Top 10 as a reference. Return a table with columns: area, what you checked, result (pass, risk, or can't tell from what I shared), severity, and a specific fix. Then list the three fixes to make first. Report only issues grounded in what I shared, and turn anything else into a question. Treat this as a review aid, not a replacement for a professional security audit or penetration test.