{
  "action": "scan_code",
  "code": "import sqlite3\n\ndef get_user(username):\n    conn = sqlite3.connect(\u0027app.db\u0027)\n    cursor = conn.cursor()\n    query = f\"SELECT * FROM users WHERE name = \u0027{username}\u0027\"\n    cursor.execute(query)\n    return cursor.fetchall()\n",
  "language": "python"
}

{
  "action": "scan_code",
  "findings": [
    {
      "line": 5,
      "message_ko": "f-string\uc73c\ub85c SQL\uc744 \uc870\ub9bd\ud558\uace0 \uc788\uc2b5\ub2c8\ub2e4. \ud30c\ub77c\ubbf8\ud130\ud654 \ucffc\ub9ac\ub97c \uc0ac\uc6a9\ud558\uc138\uc694.",
      "rule_id": "PY-INJ-002",
      "severity": "critical"
    }
  ],
  "language_detected": "python",
  "severity_counts": {
    "critical": 1,
    "high": 0,
    "low": 0,
    "medium": 0
  },
  "summary_en": "2 finding(s) \u2014 critical: 1, high: 0, medium: 0, low: 0",
  "summary_ko": "\ucd1d 2\uac1c \ucde8\uc57d\uc810 \ubc1c\uacac (\uc2ec\uac01: 1, \ub192\uc74c: 0, \uc911\uac04: 0, \ub0ae\uc74c: 0)",
  "total_findings": 2
}

{
  "action": "scan_code",
  "code": "const mysql = require(\u0027mysql2/promise\u0027);\n\nasync function findUser(userId) {\n  const sql = `SELECT * FROM users WHERE id = ${userId}`;\n  const [rows] = await pool.query(sql);\n  return rows;\n}\n",
  "language": "nodejs"
}

{
  "action": "scan_code",
  "language_detected": "nodejs",
  "severity_counts": {
    "critical": 1,
    "high": 0,
    "low": 0,
    "medium": 0
  },
  "summary_ko": "\ucd1d 1\uac1c \ucde8\uc57d\uc810 \ubc1c\uacac (\uc2ec\uac01: 1, \ub192\uc74c: 0, \uc911\uac04: 0, \ub0ae\uc74c: 0)",
  "total_findings": 1
}

{
  "action": "scan_query",
  "query": "SELECT * FROM users WHERE id = ${userId} -- admin bypass"
}

{
  "action": "scan_query",
  "risk_level": "critical",
  "risk_score": 90,
  "summary_en": "Risk level: critical (score: 90/100). 3 signal(s) detected.",
  "summary_ko": "\uc704\ud5d8\ub3c4: \uc2ec\uac01 (\uc810\uc218: 90/100). \ud0d0\uc9c0\ub41c \uc2e0\ud638 3\uac1c."
}

{
  "action": "suggest_fix",
  "language": "python",
  "vulnerable_code": "cursor.execute(\"SELECT * FROM orders WHERE user_id=\" + str(user_id))\n"
}

{
  "action": "suggest_fix",
  "fix_summary_ko": "python \uc548\uc804 \ud328\ud134: Python DB-API 2.0 \ud30c\ub77c\ubbf8\ud130\ud654 \ucffc\ub9ac",
  "general_principles_ko": [
    "\uc0ac\uc6a9\uc790 \uc785\ub825\uc744 \uc808\ub300 SQL \ubb38\uc790\uc5f4\uc5d0 \uc9c1\uc811 \uc0bd\uc785\ud558\uc9c0 \ub9c8\uc138\uc694.",
    "\ud56d\uc0c1 \ud30c\ub77c\ubbf8\ud130\ud654 \ucffc\ub9ac(Prepared Statement)\ub97c \uc0ac\uc6a9\ud558\uc138\uc694."
  ],
  "language": "python",
  "placeholder_style": "%s (psycopg2/MySQL) \ub610\ub294 ? (sqlite3)"
}

{
  "action": "suggest_fix",
  "language": "java",
  "vulnerable_code": "String sql = \"SELECT * FROM users WHERE id=\" + userId;\nStatement stmt = conn.createStatement();\nResultSet rs = stmt.executeQuery(sql);\n"
}

{
  "action": "suggest_fix",
  "fix_summary_ko": "java \uc548\uc804 \ud328\ud134: Java PreparedStatement \ud30c\ub77c\ubbf8\ud130\ud654 \ucffc\ub9ac (JDBC \ud45c\uc900)",
  "language": "java",
  "placeholder_style": "? (\uc704\uce58 \uae30\ubc18 \ud50c\ub808\uc774\uc2a4\ud640\ub354)"
}

{
  "action": "audit",
  "files": [
    {
      "code": "def find_user(email):\n    cursor.execute(\"SELECT * FROM users WHERE email=\u0027\" + email + \"\u0027\")\n    return cursor.fetchone()\n",
      "filename": "models/user.py"
    },
    {
      "code": "def search_products(name):\n    stmt = db.prepare(\"SELECT id, name FROM products WHERE name = %s\")\n    stmt.execute((name,))\n    return stmt.fetchall()\n",
      "filename": "models/product.py"
    }
  ],
  "language": "python"
}

{
  "action": "audit",
  "files_audited": 2,
  "risk_level": "critical",
  "rules_checked": 15,
  "summary_ko": "\ud30c\uc77c 2\uac1c \uac10\uc0ac \uc644\ub8cc. \uc704\ud5d8\ub3c4: \uc2ec\uac01."
}

{
  "action": "audit",
  "files": [
    {
      "code": "\u003c?php\n$user = $_POST[\u0027username\u0027];\n$pass = $_POST[\u0027password\u0027];\n$sql = \"SELECT * FROM users WHERE username=\u0027$user\u0027 AND password=\u0027$pass\u0027\";\n$result = mysqli_query($conn, $sql);\n?\u003e\n",
      "filename": "login.php"
    }
  ],
  "language": "php"
}

{
  "action": "audit",
  "files_audited": 1,
  "risk_level": "critical",
  "summary_ko": "\ud30c\uc77c 1\uac1c \uac10\uc0ac \uc644\ub8cc. \uc704\ud5d8\ub3c4: \uc2ec\uac01."
}