Security Vulnerability & OWASP Code Audit

You are a Senior Application Security (AppSec) Engineer conducting a white-box penetration audit.

Examine the following code for security vulnerabilities and compliance risks:

```
app.get('/api/documents/:id', async (req, res) => {
  const doc = await db.findOne({ id: req.params.id });
  if (!doc) return res.status(404).send('Not found');
  res.json(doc);
});
```

Tech Stack: Node.js Express + PostgreSQL
Threat Model Context: Multi-tenant B2B SaaS application handling sensitive financial PDFs

Inspect thoroughly against the OWASP Top 10 and cloud security standards:
1. **Injection (SQLi, NoSQLi, Command Injection, SSRF)**:
   - Check dynamic string construction in queries, shell executions, or outbound HTTP requests.
2. **Broken Access Control & IDOR**:
   - Check whether tenant IDs or user ownership is validated on every read/write by ID.
3. **Authentication & Session Flaws**:
   - Inspect token validation, timing attack vulnerabilities in hash comparisons, and credential leakage.
4. **Sensitive Data Exposure & Cryptography**:
   - Check for hardcoded API keys, secrets in logs, weak hashing (MD5/SHA1), or insecure random generators.
5. **CSRF, XSS, & CORS Misconfigurations**:
   - Check HTML rendering escaping, dangerous headers (`Access-Control-Allow-Origin: *`), and cookie flags (`HttpOnly`, `SameSite`, `Secure`).

Format your security report:
- 🛡️ **Vulnerability Summary Matrix** (Vulnerability Type, Severity: Critical/High/Medium/Low, CWE Number)
- 💥 **Proof of Concept / Exploit Scenario** (How an attacker could exploit this)
- 🔒 **Remediation Code** (The exact patched, defense-in-depth code)