@hoanghainh/komagu 2.5.0 → 2.6.0

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/priv-privilege-002.json

@@ -0,0 +1,222 @@
+{
+  "batch_id": "privilege-002",
+  "findings": [
+    {
+      "finding_id": "MASS-M-0008-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Unrestricted user creation allows role escalation",
+      "candidate_id": "M-0008",
+      "location": {
+        "file": "php-laravel/app/Http/Controllers/AccountController.php",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "php-laravel/app/Models/User.php",
+          "line": 8,
+          "why": "protected $guarded = [] allows all attributes to be mass\u2011assigned"
+        }
+      ],
+      "impact": "Any authenticated user can set the 'role' field to 'admin', escalating privileges.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Define a $fillable array that excludes privileged fields such as 'role', or explicitly set the role server\u2011side.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0009-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Team creation allows arbitrary owner assignment",
+      "candidate_id": "M-0009",
+      "location": {
+        "file": "php-laravel/app/Http/Controllers/AccountController.php",
+        "start_line": 23
+      },
+      "evidence": [
+        {
+          "file": "php-laravel/app/Models/Team.php",
+          "line": 8,
+          "why": "protected $fillable = ['name', 'owner_id'] includes the privileged field 'owner_id'"
+        }
+      ],
+      "impact": "Any authenticated user can set 'owner_id' to any user ID, creating a team under that user and gaining implicit ownership.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Remove 'owner_id' from $fillable and set it server\u2011side to the current user\u2019s ID.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0006-verdict",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Mass assignment at node-express/routes/profile.js:8 (from auditor verdict)",
+      "candidate_id": "M-0006",
+      "location": {
+        "file": "node-express/routes/profile.js",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/profile.js",
+          "line": 8,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0007-verdict",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Mass assignment at node-express/routes/profile.js:16 (from auditor verdict)",
+      "candidate_id": "M-0007",
+      "location": {
+        "file": "node-express/routes/profile.js",
+        "start_line": 16
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/profile.js",
+          "line": 16,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0010-verdict",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Mass assignment at php-laravel/app/Http/Controllers/AccountController.php:36 (from auditor verdict)",
+      "candidate_id": "M-0010",
+      "location": {
+        "file": "php-laravel/app/Http/Controllers/AccountController.php",
+        "start_line": 36
+      },
+      "evidence": [
+        {
+          "file": "php-laravel/app/Http/Controllers/AccountController.php",
+          "line": 36,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0015-verdict",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Mass assignment at python-flask/profile.py:27 (from auditor verdict)",
+      "candidate_id": "M-0015",
+      "location": {
+        "file": "python-flask/profile.py",
+        "start_line": 27
+      },
+      "evidence": [
+        {
+          "file": "python-flask/profile.py",
+          "line": 27,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0014-verdict",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Mass assignment at python-flask/profile.py:10 (from auditor verdict)",
+      "candidate_id": "M-0014",
+      "location": {
+        "file": "python-flask/profile.py",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "python-flask/profile.py",
+          "line": 10,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    }
+  ],
+  "privilege_route_verdicts": [],
+  "candidate_verdicts": [
+    {
+      "candidate_id": "M-0006",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0007",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0008",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "M-0009",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "M-0010",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0013",
+      "verdict": "safe"
+    },
+    {
+      "candidate_id": "M-0015",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0014",
+      "verdict": "needs_review"
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-1.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-1",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0001",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/struts/EditUserAction.java lines 10-13"
+      ],
+      "control_found": null,
+      "notes": "The code concatenates the request\u2011supplied user_id directly into the UPDATE statement with no ownership check, cast, or parameter binding visible in the provided context."
+    },
+    {
+      "finding_id": "BOLA-R-0002",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "classic-asp/shop/member.asp lines 6-7"
+      ],
+      "control_found": null,
+      "notes": "The UPDATE statement uses Request.Form(\"member_id\") without any ownership verification, cast, or allow\u2011list in the visible code."
+    },
+    {
+      "finding_id": "BOLA-R-0003",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "classic-asp/shop/member.asp lines 9-10"
+      ],
+      "control_found": null,
+      "notes": "The DELETE statement directly uses Request.QueryString(\"member_id\") with no ownership check or sanitisation shown."
+    },
+    {
+      "finding_id": "BOLA-R-0004",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "classic-asp/shop/order.asp lines 5-6"
+      ],
+      "control_found": null,
+      "notes": "The SELECT statement retrieves orders by id from the request without an ownership filter; the later block that checks user_id uses a different parameter (sid) and is not applicable."
+    },
+    {
+      "finding_id": "BOLA-R-0005",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "coldfusion/app/OrderService.cfc lines 4-5"
+      ],
+      "control_found": null,
+      "notes": "The query interpolates arguments.orderId directly into the SQL without any ownership check, cast, or allow\u2011list in the visible code."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-10.json

@@ -0,0 +1,67 @@
+{
+  "batch_id": "verified-10",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0060",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/mongo_find.php lines 5-6",
+        "php-plain/inc/auth.php lines 2-6"
+      ],
+      "control_found": null,
+      "notes": "The endpoint performs a MongoDB query using user-supplied parameters without any ownership filter. The included auth.php only checks for a logged\u2011in user, not for ownership of the returned documents."
+    },
+    {
+      "finding_id": "INJ-I-0001",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/member.asp lines 6-8",
+        "classic-asp/shop/member.asp line 10",
+        "classic-asp/shop/inc/auth.asp line 2"
+      ],
+      "control_found": null,
+      "notes": "The SQL UPDATE and DELETE statements concatenate Request.Form(\"member_id\") directly into the query. No role or ownership check is present, and the only sanitization is for the name field."
+    },
+    {
+      "finding_id": "INJ-I-0002",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/member.asp line 7",
+        "classic-asp/shop/inc/auth.asp line 2"
+      ],
+      "control_found": null,
+      "notes": "Same vulnerability as INJ-I-0001: member_id is concatenated without validation or ownership enforcement."
+    },
+    {
+      "finding_id": "INJ-I-0003",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/member.asp line 10",
+        "classic-asp/shop/inc/auth.asp line 2"
+      ],
+      "control_found": null,
+      "notes": "The DELETE statement uses Request.QueryString(\"member_id\") directly, exposing the same injection risk and lacking any ownership check."
+    },
+    {
+      "finding_id": "INJ-I-0004",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/order.asp lines 5-6",
+        "classic-asp/shop/order.asp lines 10-13",
+        "classic-asp/shop/inc/auth.asp line 2"
+      ],
+      "control_found": null,
+      "notes": "The first SELECT uses the raw id parameter without casting or ownership filtering. The second SELECT casts sid and user_id but still only protects that specific query; the initial query remains vulnerable."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-11.json

@@ -0,0 +1,68 @@
+{
+  "batch_id": "verified-11",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0005",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/order.asp line 11",
+        "classic-asp/shop/order.asp line 12"
+      ],
+      "control_found": {
+        "file": "classic-asp/shop/order.asp",
+        "line": 11,
+        "code": "sid = CLng(Request.QueryString(\"sid\"))"
+      },
+      "notes": "The sid value is cast to a long integer and the user_id is also cast to a long before concatenation, ensuring numeric values and preventing SQL injection. The query also filters by user_id, providing an ownership check."
+    },
+    {
+      "finding_id": "INJ-I-0006",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "coldfusion/app/OrderService.cfc line 5"
+      ],
+      "control_found": null,
+      "notes": "No parameter binding, casting, or ownership check is visible in the provided code. The query concatenates the raw argument, so an attacker could inject SQL."
+    },
+    {
+      "finding_id": "INJ-I-0007",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "coldfusion/app/order.cfm line 3",
+        "coldfusion/app/order.cfm lines 5-8"
+      ],
+      "control_found": null,
+      "notes": "The first query (qOrder) concatenates the raw URL id without parameterization or casting. Although a second query uses cfqueryparam and filters by user_id, the vulnerable query remains executable."
+    },
+    {
+      "finding_id": "INJ-I-0010",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Orders/EditOrder.aspx.vb lines 7-8"
+      ],
+      "control_found": null,
+      "notes": "The SQL string is built by concatenating txtNote.Text and hfOrderId.Value directly. No parameterization, casting, or ownership check is present in the visible code."
+    },
+    {
+      "finding_id": "INJ-I-0011",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs line 13",
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs line 19",
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs line 20"
+      ],
+      "control_found": null,
+      "notes": "Three unsanitized queries are executed: one concatenates the id from the query string, another uses string.Format with a request parameter, and the third uses string interpolation with a form value. No parameter binding or ownership check is applied to these queries."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-12.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-12",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0012",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs lines 13-22"
+      ],
+      "control_found": null,
+      "notes": "The code concatenates user input into SQL statements (sql2 and sql3) and executes them. No ownership or role check, integer cast, or parameter binding is visible in the provided context."
+    },
+    {
+      "finding_id": "INJ-I-0013",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs lines 13-22"
+      ],
+      "control_found": null,
+      "notes": "Same as INJ-I-0012: the DELETE query uses unsanitized input and is executed. No control is shown in the context."
+    },
+    {
+      "finding_id": "INJ-I-0014",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/WebContent/order/detail.jsp lines 1-6"
+      ],
+      "control_found": null,
+      "notes": "The query concatenates the request parameter \"no\" directly into the SQL string and is executed. No ownership or role check is present in the snippet."
+    },
+    {
+      "finding_id": "INJ-I-0016",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/struts/EditUserAction.java lines 10-15"
+      ],
+      "control_found": null,
+      "notes": "The UPDATE statement concatenates user-supplied email and userId into the SQL string. No ownership or role check is visible in the provided context."
+    },
+    {
+      "finding_id": "INJ-I-0017",
+      "verdict": "likely",
+      "reason_code": "code_not_visible",
+      "confidence": "medium",
+      "checked": [
+        "java-legacy/src/com/acme/web/InvoiceController.java lines 27-30"
+      ],
+      "control_found": null,
+      "notes": "The HQL query concatenates the \"customer\" request parameter directly into the query string and is executed. No ownership or role check is shown in the snippet."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-13.json

@@ -0,0 +1,60 @@
+{
+  "batch_id": "verified-13",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0020",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/orders.js:17"
+      ],
+      "control_found": null,
+      "notes": "The query concatenates user input directly into the SQL string with no cast, allow\u2011list, or parameter binding. No ownership or role check is present in the visible code."
+    },
+    {
+      "finding_id": "INJ-I-0021",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/orders.js:29"
+      ],
+      "control_found": null,
+      "notes": "The query uses template literal concatenation of req.query.shop without any integer cast or allow\u2011list. No ownership or role check is visible."
+    },
+    {
+      "finding_id": "INJ-I-0022",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/orders.js:17"
+      ],
+      "control_found": null,
+      "notes": "Same as INJ-I-0020: direct string concatenation of req.query.month with no sanitisation or ownership guard."
+    },
+    {
+      "finding_id": "INJ-I-0023",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/orders.js:25"
+      ],
+      "control_found": null,
+      "notes": "MongoDB $where clause concatenates req.query.n directly. No cast, allow\u2011list, or parameter binding is present."
+    },
+    {
+      "finding_id": "INJ-I-0024",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "perl-cgi/cgi-bin/order.cgi:13"
+      ],
+      "control_found": null,
+      "notes": "The prepare statement interpolates $id directly into the SQL string. No parameter binding or sanitisation is used."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-14.json

@@ -0,0 +1,64 @@
+{
+  "batch_id": "verified-14",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0025",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "perl-cgi/cgi-bin/order.cgi"
+      ],
+      "control_found": null,
+      "notes": "The DELETE statement concatenates the cart_id directly from user input with no sanitisation, cast, or ownership check. No compensating control is visible in the provided context."
+    },
+    {
+      "finding_id": "INJ-I-0027",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php"
+      ],
+      "control_found": {
+        "file": "php-plain/admin.php",
+        "line": 7,
+        "code": "$uid = (int)$_GET['uid'];"
+      },
+      "notes": "The SELECT query on line 8 is protected by an integer cast on $uid, mitigating injection for that statement. However, the DELETE query on line 12 uses $id from $_POST without casting or any ownership check, leaving it vulnerable."
+    },
+    {
+      "finding_id": "INJ-I-0028",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php"
+      ],
+      "control_found": null,
+      "notes": "The DELETE query on line 12 concatenates $id directly from user input with no sanitisation, cast, or ownership check. No compensating control is visible."
+    },
+    {
+      "finding_id": "INJ-I-0029",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/mongo_find.php"
+      ],
+      "control_found": null,
+      "notes": "The $where clause concatenates $_GET['n'] directly into a MongoDB query string. No sanitisation, cast, or allow\u2011list is present."
+    },
+    {
+      "finding_id": "INJ-I-0030",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/mongo_find.php"
+      ],
+      "control_found": null,
+      "notes": "Same as INJ-I-0029: unsanitised user input is embedded in a MongoDB $where expression with no mitigating controls."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/gptoss-b/findings/verified-15.json

@@ -0,0 +1,70 @@
+{
+  "batch_id": "verified-15",
+  "verifications": [
+    {
+      "finding_id": "INJ-I-0031-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/order_detail.php:5-6",
+        "php-plain/inc/auth.php",
+        "php-plain/inc/db.php"
+      ],
+      "control_found": null,
+      "notes": "The query concatenates the raw $_GET['id'] value without any cast, sanitisation, or parameter binding. No ownership or role check is present in the visible code."
+    },
+    {
+      "finding_id": "INJ-I-0032-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/search.php:5-9",
+        "php-plain/inc/auth.php",
+        "php-plain/inc/db.php"
+      ],
+      "control_found": null,
+      "notes": "The ORDER BY clause is built from the unsanitised $_GET['sort'] value. No allow\u2011list, cast, or ownership check is visible."
+    },
+    {
+      "finding_id": "INJ-I-0033-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/search.php:5-9",
+        "php-plain/inc/auth.php",
+        "php-plain/inc/db.php"
+      ],
+      "control_found": null,
+      "notes": "Duplicate of INJ-I-0032-1; same lack of sanitisation or ownership guard."
+    },
+    {
+      "finding_id": "INJ-I-0034-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/search.php:5-14",
+        "php-plain/inc/auth.php",
+        "php-plain/inc/db.php"
+      ],
+      "control_found": null,
+      "notes": "The category filter uses raw $_GET['cat'] inside a heredoc without escaping or parameter binding. No ownership or role check is present."
+    },
+    {
+      "finding_id": "INJ-I-0036-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "python-flask/app.py:24-30",
+        "python-flask/app.py:10-13",
+        "python-flask/app.py:16-21"
+      ],
+      "control_found": null,
+      "notes": "The search query interpolates the user supplied 'q' directly into the SQL string. No parameter binding, sanitisation, or ownership check is visible."
+    }
+  ]
+}