Find the security boundaries this generated profile handler fails to enforce.
JavaScript
async function getProfile(req, db) {
if (!req.user) return { status: 401 };
const result = await db.query(
'SELECT display_name FROM profiles WHERE id = $1',
[req.params.id],
);
return { status: 200, body: `<h1>${result.rows[0].display_name}</h1>` };
}