Code Review Assistant

🚨 Critical Security Issues Found

1. SQL Injection (CRITICAL)

// VULNERABLE

const query = `SELECT * FROM users WHERE username = '${username}'...`

// FIXED - Use parameterized queries

const query = 'SELECT * FROM users WHERE username = ? AND password = ?';

db.query(query, [username, hashedPassword], ...)

2. Plain Text Passwords (CRITICAL)

Passwords should never be stored or compared in plain text.

// Use bcrypt for password hashing

const isValid = await bcrypt.compare(password, user.hashedPassword);

3. Hardcoded JWT Secret (HIGH)

// Move to environment variable

jwt.sign({ user: username }, process.env.JWT_SECRET)

4. Missing Input Validation (MEDIUM)

Add validation for username/password format and length.

5. No Rate Limiting (MEDIUM)

Add rate limiting to prevent brute force attacks.