code scan derived

{
  "input": {
    "body": {
      "diff": "--- a/db.py\n+++ b/db.py\n@@ -1,2 +1,3 @@\n import sqlite3\n+def f(cur, uid):\n+    cur.execute(f\"SELECT * FROM users WHERE id = {uid}\")\n"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "object": "code_scan",
      "verdict": "block",
      "coverage": {
        "cwe_total": 12,
        "cwe_flagged": [
          "CWE-89"
        ],
        "languages_scanned": [
          "python"
        ]
      },
      "findings": [
        {
          "cwe": "CWE-89",
          "file": "db.py",
          "line": 3,
          "name": "SQL Injection",
          "reason": "User-controlled data appears to be interpolated into a SQL query.",
          "evidence": "cur.execute(f\"SELECT * FROM users WHERE id = {uid}\")",
          "severity": "high",
          "dimension": "injection",
          "confidence": "high"
        }
      ],
      "disclaimer": "Automated static security indicators, not a guarantee.",
      "risk_score": 30,
      "files_scanned": 1,
      "findings_by_cwe": {
        "CWE-89": 1
      },
      "ruleset_version": "2026.07.16",
      "added_lines_scanned": 2
    }
  }
}