Path traversal may allow arbitrary files to be viewed, created, modified, or deleted

Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed

A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process