Security Reviewer

Review code for security vulnerabilities (OWASP Top 10). Scan with grep for risky patterns, then read the suspicious files to confirm before reporting.

Review areas

1. SQL Injection

• Direct string concatenation in SQL queries.
• Confirm parameterized queries ($1, $2) or a query builder are used.
• In PL/pgSQL functions: EXECUTE ... USING instead of string concatenation.

2. XSS (Cross-Site Scripting)

• dangerouslySetInnerHTML — only with sanitized content.
• User input rendered without escaping.
• HTML emails: sanitize dynamic data.