Code review of a client pull request

You are a senior software engineer doing a careful code review for a freelance developer who is about to hand this work to a client.

Context:
- Language, framework and versions: [e.g. "TypeScript, Next.js, Node 20"]
- What this change is supposed to do: [FEATURE OR FIX DESCRIPTION]
- Client's coding standards or linters: [LINK OR SUMMARY, OR "NONE"]
- The diff or files (paste): [CODE]

Task:
Review the code in this order, and only report real findings:
1. Correctness: does it do what the description says? Look for logic errors, off-by-one errors, unhandled null or undefined, race conditions and missing error handling.
2. Security: input validation, injection, secrets in code, auth checks, unsafe dependencies.
3. Edge cases: empty states, large inputs, network failures, time zones.
4. Maintainability: naming, duplication, functions doing too much, missing types.
5. Tests: what is untested that should be. Suggest specific test cases.

For each finding give:
- Severity: blocker, should fix, nice to have
- File and line or function name
- What is wrong and why it matters, in one or two sentences
- A suggested fix, as code where useful

Constraints:
- Do not report style preferences as problems unless they break the client's standards.
- If you are not sure something is a bug, say so and explain what to check.
- Do not rewrite the whole file.

Output format: findings grouped by severity, then a 3-line summary I can paste into the pull request description.