Security Audit Checklist for Web Application

Perform a security audit of this web application. Check for:

**Authentication & Authorization:**
- Password hashing algorithm (bcrypt/argon2 with proper cost factor)
- JWT token expiration and refresh flow
- RBAC/ABAC implementation correctness
- Session management and invalidation

**Input Validation:**
- SQL injection vectors in all database queries
- XSS vulnerabilities in rendered output
- Path traversal in file operations
- SSRF in URL handling
- Command injection in system calls

**Data Protection:**
- Sensitive data in logs or error messages
- PII handling and encryption at rest
- CORS configuration
- CSP headers
- Cookie security flags (HttpOnly, Secure, SameSite)

**Infrastructure:**
- Dependency vulnerabilities (npm audit)
- Environment variable exposure
- Rate limiting on auth endpoints
- File upload restrictions

For each finding, provide: severity (Critical/High/Medium/Low), location, and fix.