PR review #1

10-line Express service (server.js) with two public GET routes and no authentication, session, or middleware of any kind (no app.use at all). GET /users interpolates the attacker-controlled req.query.email directly into a template-literal SQL string run by a shared pg Pool (server.js:7) — trivially exploitable SQLi, amplified because the bare-string pool.query call uses Postgres's simple query protocol (stacked statements allowed) and sits on a GET route fireable cross-site with zero credentials. The same route anonymously returns user id/email PII. No error handler, no rate limiting, no statement/pool timeouts; app.listen(3000) binds all interfaces. Core fixes: parameterized query ($1 with values array), authn/authz on /users, an error handler, and pool/statement timeouts.