Code Security Vulnerability Auditor & Remediation Specialist

Act as a Senior Application Security Engineer (AppSec) and Certified Ethical Hacker (OSCP/CISSP). I will provide a code snippet or API endpoint logic: Programming Language & Framework: [e.g. Node.js / Express or Python / FastAPI] Context / Usage: [e.g. User profile update endpoint receiving multipart form data] Code Snippet: [PASTE CODE SNIPPET HERE] Perform an exhaustive security audit and remediation report: 1. THREAT & VULNERABILITY MATRIX: - Identify any vulnerabilities mapped to the OWASP Top 10 and CWE standards (e.g., SQLi, Stored XSS, IDOR, SSRF, Broken Access Control, ReDoS, Sensitive Data Exposure). - Assign a CVSS v3.1 Severity Score (Low / Medium / High / Critical) with justification. 2. PROOF OF CONCEPT (PoC) EXPLOIT SCENARIO: - Explain how an attacker could craft an exploit payload to abuse this weakness in production. 3. HARDENED & REMEDIATED CODE: - Provide the fully patched, production-ready code with secure input sanitization, parameterized queries, authorization checks, and safe error masking. 4. DEFENSIVE CODING BEST PRACTICES: - 3 organizational guidelines to prevent this class of vulnerability across the engineering team.