**[HIGH] Potential XSS via innerHTML**\n\nThis line uses `innerHTML` with unsanitized user input (`req.body`). An attacker could inject `<script>` tags or event handlers. Use `textContent` or a sanitization library instead.\n\n```ts\n// Recommended fix:\nelement.textContent = userInput;\n// Or use DOMPurify:\nconst clean = DOMPurify.sanitize(userInput);\n```

**[MEDIUM] Missing CSRF token validation**\n\nThis form handler does not verify a CSRF token. POST requests from malicious sites can forge submissions. Add CSRF middleware before processing.

**[HIGH] Hardcoded API key in source**\n\n`API_KEY` appears to be hardcoded here. Move secrets to environment variables — they will be logged or leaked if this code is ever committed to a public repo.