A pull request adds public share links to a notes app. The tests pass and the linter is quiet. Your job is to read it the way an attacker would, and to say what must change before it ships. Three findings are hiding in the code on the next screen.