Security pass on code that touches user data

Security-review the code below. It handles {{describe data and who can reach it}}.

Check specifically:
1. AUTHZ — is every object access scoped to the caller's tenant and role, or does it trust an ID from the request body? Show me each place an ID is trusted.
2. AUTHN — token validation, expiry, refresh, session fixation.
3. INPUT — injection (SQL, command, template, LDAP), deserialisation, path traversal, SSRF on any URL we fetch.
4. OUTPUT — XSS sinks, PII in logs or error messages, verbose errors to clients.
5. CRYPTO — anything home-rolled, weak, or with keys in code.
6. LIMITS — rate limiting, resource exhaustion, unbounded uploads or queries.
7. DEPENDENCIES — known-risky patterns in the libraries used.

For each finding: severity, exploit scenario in concrete steps, the fix as a diff, and how to test that the fix holds. Do not list theoretical issues without an exploit path.

CODE:
{{paste}}