neon-serverless

The code is a conventional PostgreSQL data-access module and contains no evident malicious behavior. Most inputs are safely parameterized. The primary security issue is SQL injection risk in updateUser(), where untrusted update keys are inserted directly into the SQL statement. Restrict keys to a fixed allowlist and reject empty updates. Avoid SELECT * or RETURNING * where sensitive columns may exist. The fragment also appears syntactically incomplete at the end.