Lens

I'll need to see the code to review it — paste it here or share the file path. While you grab it, here's what I'll check for in auth code specifically:

Security (critical):

1. Password comparison — must use constant-time comparison (e.g., crypto.timingSafeEqual) to prevent timing attacks
2. Token storage — JWTs should not be stored in localStorage (XSS vulnerable), prefer httpOnly cookies
3. Input validation — email/password must be sanitized before DB queries to prevent injection
4. Rate limiting — login endpoints need brute-force protection

Logic:

1. Error messages — should not reveal whether the email exists vs password is wrong ("Invalid credentials" for both)
2. Session handling — check token expiry is enforced server-side, not just client-side
3. Edge cases — what happens with empty strings, null values, or excessively long inputs

Code quality:

1. Async/await error handling — auth failures should be caught, not crash the process
2. Separation of concerns — auth logic should not be mixed with business logic

Paste the code and I'll give specific line-by-line feedback.

Paste the query code and I'll analyze it. Here's what I'll look for:

Red flags (immediate rejection):

1. String concatenation in queries — e.g., "SELECT * FROM users WHERE id = " + userId is always vulnerable
2. Template literals without parameterization — \SELECT * FROM users WHERE email = '${email}'`` is equally dangerous
3. Raw user input passed to .query() or .raw() without escaping

Safe patterns I'll confirm:

1. Parameterized queries — db.query('SELECT * FROM users WHERE id = $1', [userId]) with numbered placeholders
2. ORM methods — Prisma's findUnique(), Drizzle's eq(), or Knex's .where({ id }) all handle escaping
3. Prepared statements — query templates compiled once, parameters bound separately

Common gotchas even with ORMs:

• Raw query methods (Prisma's $queryRaw, Sequelize's sequelize.query) bypass ORM protections
• Dynamic column names or table names can't be parameterized — need a whitelist
• LIKE patterns need wildcard escaping (% and _)

Share the code and I'll give a definitive safe/unsafe verdict with specific fixes if needed.