fix: the bank api uses the :user path parameter dire... in server.js

[orbisai0security]

Summary

Fix high severity security issue in 7-bank-project/api/server.js.

Vulnerability

Field	Value
ID	V-002
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-002
File	7-bank-project/api/server.js:82

Description: The bank API uses the :user path parameter directly to look up and modify account data without verifying that the authenticated requester is authorized to access that specific account. Even after authentication is added (V-001), there is no authorization check comparing the authenticated user's identity to the :user parameter in the URL. This enables horizontal privilege escalation — any authenticated user can read, modify, or delete any other user's account by simply changing the username in the URL.

Changes

• 7-bank-project/api/server.js

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security