I received a security review flagging that JWT authentication is completely bypassable in server.ts lines 348-360 and routes/verify.ts lines 60-85. The review states that unsigned JWT tokens (algorithm 'none') and forged HS256 tokens are accepted, and that jwtChallenges() middleware only marks challenges as solved rather than blocking invalid tokens. Please review these files and advise without making changes yet: 1) Show me exactly how JWT validation currently works in these locations, 2) Search the entire repository for all JWT verification middleware and list each one with whether it blocks or only logs invalid tokens, 3) List every protected endpoint and confirm whether it has blocking JWT validation, 4) Advise what minimal changes would be needed to reject forged tokens while preserving any intentional challenge functionality, providing specific code locations and the exact validation logic that should be added.

I received a security review flagging SQL injection in routes/search.ts where the searchProducts() function allows unfiltered user input directly into database queries. Please review and advise without making changes yet: 1) Show me the exact code in routes/search.ts that constructs the database query, 2) Search the entire repository for all locations where user input is used in database queries and list each one with whether it uses parameterized queries or string concatenation, 3) Identify every endpoint that accepts search, filter, or query parameters and confirm how each sanitizes input, 4) Advise what the minimal safe pattern would be for this codebase (given it uses Sequelize) to prevent SQL injection while maintaining search functionality, with specific examples of how to convert the vulnerable queries.

I received a security review flagging unrestricted file upload in server.ts lines 502-506 and routes/fileUpload.ts, stating that handleZipFileUpload and handleXmlUpload process uploaded content without proper sanitization, allowing malicious file execution. Please review and advise without making changes yet: 1) Show me the exact code in these locations that handles file uploads, 2) Search the entire repository for all file upload endpoints and list each one with what validation it currently performs (file type, size, content scanning), 3) Identify where uploaded files are stored and whether they are served back to users or executed, 4) Advise what minimal validation should be added (file type whitelist, size limits, content scanning, safe storage location) with specific code examples for this stack.

I received a security review flagging that 37 dependencies have known vulnerabilities (3 serious, 34 less severe) out of 167 packages checked against OSV.dev. Please review and advise without making changes yet: 1) Run npm audit (or yarn audit) and show me the full report with specific package names, current versions, vulnerability descriptions, and fixed versions, 2) Review package.json and list all direct dependencies with their current versions, 3) For each vulnerable package, check if an updated version is available and whether it would introduce breaking changes, 4) Advise a prioritized update plan starting with the 3 serious vulnerabilities, specifying which packages to update to which versions and any compatibility concerns to test.

I received a security review flagging that rate limiting in server.ts lines 536-541 uses X-Forwarded-For header as the key generator (line 540), which attackers can spoof to bypass rate limits. Please review and advise without making changes yet: 1) Show me the exact rate limiting configuration in these lines, 2) Search the entire repository for all rate limiting implementations and list what key each uses (IP, header, session), 3) Identify what rate limiting library is in use and what alternative key generation methods it supports, 4) Advise what the safest key would be for this deployment environment (considering proxies, load balancers) and show the specific configuration change needed.

I received a security review flagging DOM-based XSS in frontend/src/index.html and hacking-instructor/index.ts, stating that the snarkdown markdown parser (line 6) converts user input to HTML without escaping and innerHTML assignments (line 82) directly inject content. Please review and advise without making changes yet: 1) Show me the exact code at these locations that renders user input, 2) Search the entire frontend codebase for all uses of innerHTML, outerHTML, insertAdjacentHTML, and markdown parsing