Security code review
ProblemCommon vulnerabilities slip into code because nobody on the team is a security specialist.
Node: db.query(SELECT * FROM users WHERE email = '${req.body.email}')
Critical — A03 Injection, line 1: user input in SQL string.
Scenario: email = ' OR 1=1 -- returns every user.
Fix: db.query('SELECT * FROM users WHERE email = $1', [req.body.email])
Immediate resultA list of vulnerabilities mapped to the OWASP Top 10, each with severity and a fixed code snippet.


