PitchLense

Critical authentication flaws, including a hardcoded `FIXED_SALT` for password hashing and a direct hash comparison `password === user.password_hash`. This design makes user passwords vulnerable to offline brute-force attacks if the salt is compromised (which it is, being in the source code). Hardcoded default secrets for `JWT_SECRET`, `DB_PASSWORD`, and `GEMINI_API_KEY` are present, posing a severe risk if not explicitly overridden in production environments. The Content Security Policy (CSP) includes `'unsafe-eval'` in its `script-src`, which can weaken XSS protections. Positively, the application implements standard security headers, API rate limiting, uses Google Cloud Natural Language API for content moderation, and employs parameterized SQL queries to mitigate injection attacks. However, these positive controls are significantly overshadowed by the critical authentication vulnerabilities.