Review the code the AI just wrote

Review this code as a senior engineer who assumes it was generated quickly and needs to be trusted in production.

What the code is supposed to do: <one paragraph>
The code: <paste>
Where it runs: <browser / server / both>, and what data it touches: <user data, payments, files, none>
Framework and constraints: <e.g. React + Supabase, must stay on the free tier>

Review in this order, and rank findings by severity (critical / should fix / nice to have):
1. Correctness: does it do what I described? Any logic that is wrong or incomplete? Quote the lines.
2. Security and data: injection, exposed secrets, missing auth or permission checks, user input trusted without validation, data leaked to the client that shouldn't be.
3. Failure handling: what happens on a network error, a null, an empty list, a slow response, a double click.
4. Simplicity: code that does more than needed, duplicated logic, abstractions that hide rather than help.
5. Maintainability: naming, comments that explain "why", anything a teammate would trip on.

For each finding: the line(s), what's wrong, why it matters, and the minimal fix.
End with: the three things to fix before shipping, and one sentence on whether you would merge this as is.
Do not rewrite the whole file. Do not praise it.