Free AI code reviewer

Summary: Needs rework — customer_id goes straight from the URL into the SQL string, so this is an injection hole. Issues: 1. [High] q = f"SELECT * FROM orders WHERE customer_id = {customer_id} ..." Problem: customer_id comes from the URL and is pasted into the query. A value like 1 OR 1=1 returns every customer's orders. Fix: use placeholders and pass values separately: q = f"SELECT * FROM orders WHERE customer_id = ? AND status IN ({','.join('?' * len(s))})" rows = db.execute(q, [customer_id, *s]).fetchall() 2. [High] statuses=[] with statuses.append("open") Problem: the default list is created once and shared. Every call adds another "open", and a caller's own list is changed too. Fix: def get_orders(db, customer_id, statuses=None): s = list(statuses or []) + ["open"] 3. [High] total / len(rows) Problem: a customer with no orders raises ZeroDivisionError. Fix: average = total / len(rows) if rows else 0 4. [Medium] total += r["amount"] Problem: if amount is a float, sums of prices drift (0.1 + 0.2 != 0.3). Fix: store cents as integers or use Decimal. 5. [Low] SELECT * Problem: pulls every column, including ones added later. Fix: name the columns you use. Questions: Is db a sqlite3 connection? Placeholder syntax is ? for sqlite3 and %s for psycopg. What's good: Returning the rows and the average together saves the caller a second query.

Summary: Ship after fixes — the function returns before any email is sent, so the count is always 0 and failures go unnoticed. Issues: 1. [High] users.forEach(async (u) => { ... }) Problem: forEach ignores the promises its callback returns. The function logs "Sent 0 reminders" and returns 0 while the sends are still running, and a failed send becomes an unhandled rejection. Fix: collect the promises and await them: const results = await Promise.allSettled(targets.map(u => mailer.send(u.email, template(u)))); const sent = results.filter(r => r.status === 'fulfilled').length; 2. [Medium] Starting all sends at once Problem: with 20,000 users, fixing issue 1 with a single Promise.all fires 20,000 requests together and will hit the mailer's rate limit. Fix: send in batches of 50 to 100, awaiting each batch, or use a small concurrency limiter such as p-limit. 3. [Medium] No record of who failed Problem: a rerun after a partial failure emails everyone again. Fix: log or store the ids of failed sends and mark successful ones as reminded. Questions: Does mailer.send retry on its own? If so, lower the batch size. What's good: Skipping unsubscribed users before sending, not after, is the right order.

Summary: Needs rework — anyone can read any file the server can read, including .env, by putting ../ in the name. Issues: 1. [High] path.join(__dirname, 'uploads', req.query.name) Problem: path traversal. name=../../.env resolves outside uploads, and path.join does not stop it. Fix: const base = path.resolve(__dirname, 'uploads'); const file = path.resolve(base, String(req.query.name || '')); if (!file.startsWith(base + path.sep)) return res.sendStatus(404); 2. [High] No access check Problem: nothing ties a file to the user asking for it, so one customer can download another's upload by guessing names. Fix: look the file up by an id the current user owns, and serve the stored path from your database instead of the query string. 3. [Low] Missing name Problem: /download with no name makes sendFile throw. Fix: return 400 when req.query.name is missing. Questions: Is there auth middleware in front of this route that I can't see? What's good: Nothing to add.