{"controls_not_vulnerabilities":["create_user() lines 31-34 uses a parameterized INSERT — must not be flagged as SQL injection.","health() is benign."],"file":"user_service.py","lines_total":71,"planted_vulnerabilities":[{"detail":"find_user() builds a query with % string formatting on the username argument and executes it on line 42. Reachable from POST /login via verify_login(). Expected severity: High or Critical. Fix: parameterized query (placeholders), as already done in create_user().","id":1,"line":41,"type":"SQL injection"},{"detail":"STRIPE_API_KEY is a live-looking Stripe secret key committed in source. Expected severity: High. Fix: load from environment/secret manager, rotate the exposed key.","id":2,"line":11,"type":"Hardcoded API key"},{"detail":"calculate() calls eval() on the expression argument, routed directly from POST /calc request data (line 70). Expected severity: Critical. Fix: remove eval; parse with ast and a whitelist, or use a safe expression evaluator.","id":3,"line":54,"type":"eval() on user input (remote code execution)"},{"detail":"hash_password() uses hashlib.md5 — fast, unsalted, unsuitable for passwords. Expected severity: Medium or High. Fix: bcrypt/argon2/scrypt (or hashlib.scrypt / PBKDF2 with per-user salt as a stdlib fallback).","id":4,"line":25,"type":"Weak password hashing (MD5)"}],"scoring":"Findings counted per planted id. Severity accuracy: within one band of expected counts as accurate. False positives: any reported vulnerability that is not one of the four planted issues."}