Audit my app for NoSQL injection vulnerabilities. Look at every place request data (body, query string, params) is passed into a database query, especially MongoDB-style queries where user input lands inside a filter object. The specific risk: if user input is an object instead of a string, operators like $gt, $ne, or $where can change the query's meaning (the classic example is a login check where { "email": { "$ne": null }, "password": { "$ne": null } } matches any user). For each query, enforce that expected scalar fields are actually strings or numbers before they enter the query, reject or strip keys beginning with $ or containing dots from user-supplied objects, and use explicit whitelists of allowed fields when building filters from request data. Do not change the shape of my API responses or the database schema. Do not add a heavy ORM if the project queries the database directly; fix the queries in place. Keep validation errors consistent with the app's existing error format. Show me each query you hardened, the attack it was open to, and the fix. End with a reproduction I can run: a crafted request body that would have bypassed a query before your fix, and confirmation it now gets rejected.