Code Execution: Unsafe eval() of untrusted CLI arguments allowed arbitrary code execution; replaced with ast.literal_eval. Any other eval-like sink in argument parsing is a critical risk.

SQL Injection: Dynamic column names interpolated into raw ALTER TABLE without escaping; fixed by escaping double quotes. Similar raw SQL with dynamic identifiers elsewhere is a high-risk pattern.

Cross-Site Scripting (XSS): Rendering untrusted cell data via dangerouslySetInnerHTML without sanitization; fixed by adding xss library. Any other HTML rendering path for user data is a risk.