fix: the bank api has no authentication mechanism in server.js

[orbisai0security]

Summary

Fix high severity security issue in 7-bank-project/api/server.js.

Vulnerability

Field	Value
ID	V-010
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-010
File	7-bank-project/api/server.js:82

Description: The bank API has no authentication mechanism. Any caller can claim to be any user simply by placing that username in the URL path. The :user parameter is used directly as the account identifier with no verification of the caller's identity. This is closely related to V-001 but specifically addresses the identity spoofing vector — even if authentication is added, explicit authorization checks must also be implemented.

Changes

• 7-bank-project/api/server.js

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security