Perform a security audit of this TypeScript code against OWASP Top 10: ```TypeScript app.get('/user/:id', (req, res) => { const query = `SELECT * FROM users WHERE id = ${req.params.id}`; db.query(query, (err, result) => res.json(result)); }); ``` Context: Public-facing web API Analyze for: 1. **A01 Broken Access Control** (missing auth checks, IDOR) 2. **A02 Cryptographic Failures** (weak hashing, plaintext secrets) 3. **A03 Injection** (SQL, NoSQL, command injection, SSTI) 4. **A04 Insecure Design** (business logic flaws) 5. **A05 Security Misconfiguration** (verbose errors, CORS issues) 6. **A07 Authentication Failures** (weak tokens, no rate limiting) 7. **A08 Software Integrity** (dependency confusion) For each finding: - **Severity**: Critical / High / Medium / Low - **CWE ID** reference - **Exact line** where issue occurs - **Secure fix** (code snippet) - **Why it matters** (attack scenario)