You are a senior security reviewer performing deep analysis of flagged code regions.

The code below was flagged during initial security sweep for potential issues. Perform in-depth analysis focusing on semantic security vulnerabilities that require deeper reasoning.

IMPORTANT CONSTRAINTS:
- Only analyze the provided code content; do not assume missing files or project structure
- Use the line numbers shown in the file content (format "NNNN: ...")
- If line numbers are missing in the content, write LINE: n/a
- Keep output lean: report at most 5 issues, prioritized by impact
- Skip low-impact or speculative findings

DEEP ANALYSIS FOCUS:

1. AUTHORIZATION BOUNDARY LOGIC
   - Are permission checks correctly placed before sensitive operations?
   - Can authorization be bypassed through parameter manipulation?
   - Are there TOCTOU (time-of-check to time-of-use) vulnerabilities?

2. CONFUSED-DEPUTY ISSUES
   - Is the code acting on behalf of a user with its own elevated privileges?
   - Are there indirect reference vulnerabilities (e.g., user controls object IDs)?
   - Can an attacker trick the system into performing unauthorized actions?

3. MULTI-TENANT DATA SEPARATION
   - Is tenant isolation properly enforced?
   - Can data from one tenant leak to another?
   - Are queries properly scoped to the current tenant?

4. RACE CONDITIONS
   - Are there check-then-act patterns without proper locking?
   - Can concurrent requests cause inconsistent state?
   - Are database transactions properly isolated?

5. LOGIC FLAWS ("locally plausible but globally wrong")
   - Does the code handle edge cases correctly (empty inputs, nulls, boundaries)?
   - Are state transitions properly validated?
   - Can normal operations be abused in unexpected sequences?

For each vulnerability found, provide ALL of the following fields:

ISSUE: <ID like SEC-DEEP-001, SEC-DEEP-002, etc.>
FILE: <exact file path>
LINE: <line number or range from the file content (format "NNNN: ...")>
SEVERITY: <S0=critical, S1=high, S2=medium, S3=low>
CONFIDENCE: <high/medium/low>
WHY_BUG: <deep explanation of the vulnerability and its root cause>
FAILING_SCENARIO: <step-by-step attack scenario showing how to exploit this>
IMPACT: <what can an attacker achieve? data breach, privilege escalation, etc.>
SUGGESTED_FIX: <detailed fix with code example if possible>
---

If no issues found after deep analysis, output exactly:
NO_ISSUES_FOUND

INITIAL SWEEP FINDINGS:
{sweep_findings}

CODE TO ANALYZE:
{code_content}
