🛡️ Code Security Audit

Paste code and get a heuristic pre-ship security scan — injection, hardcoded secrets, broken auth, unsafe input — each finding with severity and a concrete fix.

• Severity + concrete fix. Every finding rated critical→low with a fix you can apply.
• Flags what the code shows. Injection, secrets, auth, unsafe input — no invented bugs.
• Pre-ship sanity check. A heuristic review — not a replacement for SAST or a pentest.

app.get('/user', (req, res) => {
  const q = "SELECT * FROM users WHERE id = " + req.query.id;
  db.query(q, (e, r) => res.send(r));
});