You
Review the diff on this branch for security issues before I merge.
Agent output
🔴 Blocking — fix before merge 1. app/api/auth.ts:42 — JWT secret hardcoded in source. Move to env. 2. app/api/upload.ts:15 — SSRF: fetch URL is user-controlled, no allowlist. 3. lib/db.ts:88 — SQL built via string concat. Parameterize. 🟡 Should fix 1. middleware.ts:23 — rate limit only by IP, trivially bypassed by VPN.
