Review my vibe code

Review this code the way a sceptical senior dev would. Look for:
1. Things that will break with real user input (empty, huge, weird characters).
2. Anything secret that shouldn't be in the file (API keys, tokens, passwords).
3. Anything that talks to a database or the network without error handling.
4. Copy-pasted blocks that should be one function.

For each finding: the line, why it matters, and the smallest fix.
Rank by "would actually bite me" — skip style nitpicks.

<paste file>