Find the security bug in this generated order reader.
JavaScript
async function getOrder(request, db) {
const principal = await authenticate(request.headers.authorization);
const order = await db.orders.find(request.params.orderId);
if (!order) return { status: 404 };
return { status: 200, body: order };
}