Your question is Application Security Code Review. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
Find as many vulnerabilities as you can in this application by going through the source code.
Review the provided source code, configuration, dependencies, and deployment manifests as an attacker would. For each finding, explain the attack path, affected asset, severity, remediation, and how you would verify the fix. Prioritize exploitable issues over stylistic concerns and state assumptions where the code does not establish behavior.