Defensive security audit

Perform a defensive audit of the following [APPLICATION] design or code. Limit the work to prevention and remediation. Review authentication, authorization, validation, secrets, uploads, sessions, logging, privacy and dependencies. For each finding provide evidence, impact, likelihood, priority and a concrete fix. Separate confirmed vulnerabilities from hypotheses. Do not provide instructions for attacking real systems.

Material: [CODE_OR_DIAGRAM]