sec-reviewlisted

# Peephole security review Peephole's write-time gate catches *present* insecure patterns. This review adds the part a regex cannot prove: **missing** guards. Review the current diff against this checklist and report concrete findings with file:line. Present (Peephole enforces these at write time — verify none slipped through in audit mode): - CWE-89 SQL injection — string-built queries instead of parameters - CWE-94 code injection — eval/exec/new Function on dynamic input - CWE-502 unsafe deserialization — pickle/yaml.load/node-serialize on untrusted data - CWE-79 XSS — unescaped output, dangerouslySetInnerHTML, `| safe` - CWE-78 command injection — shell=True / exec with interpolation - CWE-22 path traversal — join(base, user_input) without containment check - CWE-798 hardcoded secrets - CWE-327 weak crypto — fast/unsalted password hashes, ECB, non-CSPRNG for secrets - CWE-1188 disabled controls — verify=False, DEBUG=True, csrf_exempt, wildcard CORS+credentials Absence — cannot be regex-proven; check by reading (this is where real bugs hide): - CWE-862/863 missing/incorrect authorization on state-changing or cross-user routes - CWE-639 IDOR — object lookups keyed on a client-supplied id without ownership scoping - CWE-352 CSRF on state-changing endpoints - CWE-306 missing authentication on a sensitive endpoint - CWE-770 missing rate limiting on expensive or auth endpoints For each finding: state the CWE, the file:line, the exploit in one sentence, and the fix. ## Chall