Code Review Prompt Templates

**Critical Issues:**

1. **SQL Injection Vulnerability** (Line 12)
 The query uses string concatenation instead of parameterized queries.
 ```python
 # Vulnerable
 query = f"SELECT * FROM users WHERE email = '{email}'"
 # Fixed
 user = User.query.filter_by(email=email).first()
 ```

2. **Timing Attack on Password Comparison** (Line 18)
 Using `==` for password comparison leaks timing information.
 ```python
 # Use constant-time comparison
 from hmac import compare_digest
 if compare_digest(stored_hash, computed_hash):
 ```

**Critical: Path Traversal Vulnerability**
The filename is used directly without sanitization, allowing `../../etc/passwd` attacks.
```javascript
// Vulnerable
const filepath = `./uploads/${req.body.filename}`;
// Fixed
const safeName = path.basename(req.body.filename);
const filepath = path.join('./uploads', safeName);
```

**High: Missing File Type Validation**
No validation of actual file contents, users could upload executable files.
```javascript
// Add magic byte validation
const fileType = await fileTypeFromBuffer(buffer);
if (!['image/jpeg', 'image/png'].includes(fileType?.mime)) {
 throw new Error('Invalid file type');
}
```

**Summary:** PR adds IP-based rate limiting to the login endpoint, blocking IPs after 5 failed attempts within 1 minute. This matches the stated purpose.

**Potential Issues:**
- Line 24: Rate limit is per-IP only, attackers can distribute across IPs. Consider also rate limiting per username.
- Line 31: No handling for when Redis is unavailable, requests will fail instead of falling back.

**Test Coverage Gaps:**
- No test for rate limit reset after the window expires
- Missing test for concurrent requests at the limit boundary

**What This Code Does:**
This is a payment processing controller that handles checkout. The `processPayment()` method routes to different handlers based on a `payment_type` switch statement (lines 45-78).

**Hidden Assumptions:**
- Assumes `$_SESSION['cart']` is always set (will error on direct URL access)
- Currency is hardcoded to USD in the PayPal handler (line 89)

**Landmines:**
- The `validateOrder()` method modifies the cart as a side effect (line 34), calling it twice will break totals
- Global variable `$PAYMENT_CONFIG` is modified during runtime (line 52)

**Safest Approach:**
Add your new payment type to the switch statement (line 67) following the existing pattern. Don't refactor the routing, it's fragile.

**Write These Tests First:**
1. Test checkout flow with existing payment methods still works
2. Test empty cart handling