You are an expert code reviewer performing a thorough security and quality audit. Analyze the git diff below and report every real issue you find.

Return ONLY valid JSON. No explanations outside the JSON.

```json
{
  "findings": [
    {
      "id": "F001",
      "file": "path/to/file.ts",
      "line_start": 1,
      "line_end": 1,
      "category": "security",
      "subcategory": "hardcoded_secret",
      "severity": "critical",
      "title": "Short descriptive title",
      "explanation": "Why this is a problem and what could go wrong.",
      "code_snippet": "the actual problematic line(s) from the diff",
      "suggested_fix": "Concrete fix.",
      "references": []
    }
  ]
}
```

---

## CHECKLIST — scan for ALL of the following:

### security
- [ ] Hardcoded secrets: API keys, tokens, passwords, private keys in source code (look for strings like `sk-`, `Bearer `, `password =`, `secret =`, `token =`)
- [ ] SQL injection: template literals or string concatenation used in database queries (`SELECT ... ${variable}`, `query + req.params`)
- [ ] Missing authentication: endpoints or functions that handle user data without checking who the caller is
- [ ] Missing input validation: user-controlled input (`req.body`, `req.params`, `req.query`) used directly without validation
- [ ] Path traversal: user input used in file paths
- [ ] Insecure file uploads: no file type or size restrictions

### database
- [ ] N+1 queries: a loop that runs a database query on each iteration
- [ ] Missing transactions: multiple DB writes that should be atomic but aren't wrapped in a transaction
- [ ] Unsafe migrations: adding a NOT NULL column without a DEFAULT value to an existing table
- [ ] Fetching all rows: `SELECT *` or `.find({})` with no WHERE clause on large tables

### ux
- [ ] Missing ARIA: interactive elements (`<button>`, `<input>`, `<a>`, icon-only buttons) with no `aria-label` or `aria-labelledby`
- [ ] Error state never rendered: an `error` variable is set in state but the JSX never shows it to the user
- [ ] Loading state doesn't block action: a submit button or action is not disabled while a request is in progress
- [ ] Missing loading indicator: async operation with no visual feedback

### architecture
- [ ] Wrong import direction: a service/utility importing from a routes/ or controllers/ directory (dependency inversion)
- [ ] God function: a single function over 30 lines that does fetching + business logic + side effects
- [ ] Code duplication: same logic copy-pasted in multiple places
- [ ] Inconsistent error handling patterns

### tests
- [ ] Always-true assertions: `expect(true).toBe(true)`, `expect(x).toBeDefined()` on a hardcoded value — tests that can never fail
- [ ] Mocks that never return edge cases: a mock always returning success, never testing the error/undefined path
- [ ] Missing test for new code: a new function or endpoint has no corresponding test

### documentation
- [ ] JSDoc mismatch: `@param` or `@returns` tags that describe parameters that don't exist in the actual function signature
- [ ] Outdated docs: README, comments, or docs referencing an old endpoint URL, function name, or behavior that has changed in this diff

---

Report EVERY issue you find from the checklist above. Use the actual file names and line numbers from the diff (lines starting with `+` are new/changed code).

Diff to analyze: