Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@src/main/java/org/example/visacasemanagementsystem/config/SecurityConfig.java`:
- Line 39: The security rule allowing any authenticated user for
"/api/comments/**" is too permissive; tighten it in SecurityConfig by replacing
.requestMatchers("/api/comments/**").authenticated() with a role-restricted
matcher such as .requestMatchers("/api/comments/**").hasRole("USER") (or another
appropriate authority used by your app) so only intended roles can access
comment endpoints, and then update CommentController (and the service it calls,
e.g., createComment) to stop trusting CreateCommentDTO.authorId(): obtain the
author from the authenticated principal (via `@AuthenticationPrincipal` or
SecurityContextHolder) and enforce visa-access checks there before creating or
returning comments.

In
`@src/test/java/org/example/visacasemanagementsystem/visa/VisaViewControllerTest.java`:
- Around line 474-484: The tests currently mutate SecurityContextHolder in
createMockUser() by building a UserPrincipal and TestingAuthenticationToken;
instead refactor createMockUser(Long id, UserAuthorization role) to return a
plain UserDTO (no SecurityContextHolder or UserPrincipal creation) and stop
calling SecurityContextHolder.getContext().setAuthentication(...) in that
helper; for each MockMvc request attach the authentication scoped to that
request with .with(authentication(new TestingAuthenticationToken(new
UserPrincipal(userEntityOrDTO), "password", authorities))) (or use Spring
Security's RequestPostProcessor), remove all stale .param("currentUserId", ...)
from requests, and keep using `@WithMockUser` only where appropriate so
`@AuthenticationPrincipal` and `@PreAuthorize` resolve the correct per-request
principal.

---

Outside diff comments:
In
`@src/main/java/org/example/visacasemanagementsystem/visa/controller/VisaViewController.java`:
- Around line 134-161: In processUpdate, fetch the target VisaDTO via
visaService.findVisaDtoById(id) and verify the applicant matches
principal.getUserId() before any early return or exception handling that
redisplays the form; if the current user is not the owner, reject the request
(throw AccessDeniedException or return a 403 view) instead of loading or
exposing visa.statusInformation. Apply this check both at the start of the
method (before the bindingResult.hasErrors() block) and in the catch block prior
to calling visaService.findVisaDtoById(id) so ownership is always validated
before redisplaying the edit form.

In `@src/main/resources/templates/visa/dashboard.html`:
- Around line 125-126: Replace the plain anchor link to "/visas/logout" with a
POST-based logout form that posts to Spring Security’s standard "/logout"
endpoint and includes the CSRF token; specifically, remove the <a> sign-out link
and render a form (th:action="@{/logout}" method="post") containing a submit
button and a hidden CSRF input using Thymeleaf expressions (use
${_csrf.parameterName} and ${_csrf.token}); alternatively, if you prefer
controller-driven logout, wire the sign-out button to a dedicated controller
method that invokes SecurityContextLogoutHandler to perform the logout and then
redirects.

---

Nitpick comments:
In
`@src/main/java/org/example/visacasemanagementsystem/user/controller/UserViewController.java`:
- Around line 150-160: The adminDashboard method currently passes the string
"SUBMITTED" to visaService.findVisaByStatus; replace this string literal with
the VisaStatus enum constant to avoid brittle string usage—call the service with
VisaStatus.SUBMITTED (or convert enum to the required method parameter type) in
adminDashboard (which uses visaService.findVisaByStatus and
visaService.findVisasByHandlerId) so the code relies on the enum instead of a
raw string and prevents future typos or invalid values.

In
`@src/test/java/org/example/visacasemanagementsystem/visa/VisaViewControllerTest.java`:
- Around line 81-82: Remove the stale .param("currentUserId", ...) occurrences
from the security-focused requests in VisaViewControllerTest (e.g., the
mockMvc.perform(get("/visas/dashboard")...) call and the other listed visa
request calls) so tests no longer rely on request-controlled identity; instead
ensure the request identity is provided via authenticated principal resolution
(use the existing security test helpers to set the principal, e.g., the
SecurityMockMvcRequestPostProcessors or your test user setup) and update the
assertions to validate principal-derived behavior.