Security-review a small planted web app backend like an attacker and report only real flaws

# Security-review a small planted web app backend like an attacker and report only real flaws The backend is a small synthetic app that lives only in these files; it is your own planted code with no live service, no open ports and nothing to reach over a network. Inputs: the handler source under `backend/` (several `*.py` files, each with top-level `def <route>(req):` handlers) and `review-brief.txt`. Review every handler as an attacker would and report only flaws you can prove from the code. Invented findings are penalised as hard as misses, so do not report a handler that is actually safe. Flaw vocabulary (use exactly these labels): `sql_injection`, `broken_access_control`, `path_traversal`, `plaintext_secret`, `reflected_xss`, `ssrf`. Rules: - Flaws (what counts, with its proof in the handler body): - `sql_injection`: a query string built by concatenating `req[...]` into the SQL text. A parameterized query (a `?` placeholder with the value passed separately) is safe. - `broken_access_control`: an `adm*` handler that performs a privileged action without a `require_role(...)` check. An `adm*` handler that calls `require_role` first is safe. - `path_traversal`: a filesystem path built as `BASE + req[...]`. A path built with `safe_join(...)` is safe. - `plaintext_secret`: comparing `req["password"]` to a stored password directly. Using `verify_hash(...)` is safe. - `reflected_xss`: returning HTML built by concatenating `req[...]` into markup without `escape(...)`. Wrapping the value in `escape(...)` is safe. - `ssrf`: fetching `open_url(req[...])` without an `allowed_host(...)` check. Guarding with `allowed_host(...)` is safe. - Findings: report one finding per proven flaw. A handler may carry at most one flaw in this set. - Write `out/findings.json`: `{"findings": [<{"route": <name>, "flaw": <label>} sorted by (route, flaw)>], "flawed_routes": [<sorted route names with a flaw>], "flaw_types": [<sorted distinct labels found>], "total_flaws": <number>, "counts_by_type": {"<label>": <count>, ...}}`. - Roll-ups: Labels in the flaw vocabulary with no finding are included at 0. ## How this run works - Work on your own: nobody will answer questions in this task, and writing to `ask/` counts against the run. - Write only under `out/`. Create `out/` if it is missing. Inputs are synthetic; don't fetch anything from the network. - Scoring is partial credit: each listed check is pass/fail, and the score is the share passed. Numbers are compared to within 0.005 unless the task says otherwise.