{
  "summary": "Found 5 issue(s) across 1 file(s).",
  "risk": "high",
  "language": "javascript",
  "findings": [
    {
      "severity": "info",
      "category": "maintainability",
      "title": "Marker left in code",
      "detail": "TODO/FIXME/debugger/HACK marker in added lines — track or resolve before merge.",
      "path": "src/auth.js",
      "line_hint": "// TODO: move secret to vault"
    },
    {
      "severity": "critical",
      "category": "security",
      "title": "Possible hardcoded secret",
      "detail": "Added line looks like a live credential or API key. Rotate if real; use env/secret store.",
      "path": "src/auth.js",
      "line_hint": "const apiKey = \"sk-live-EXAMPLE_DO_NOT_USE_IN_PROD\";"
    },
    {
      "severity": "low",
      "category": "quality",
      "title": "Debug logging left in diff",
      "detail": "console.log/debug in shipped code may leak data or noise production logs.",
      "path": "src/auth.js",
      "line_hint": "console.log(\"login attempt\", user, pass);"
    },
    {
      "severity": "high",
      "category": "security",
      "title": "Dangerous dynamic code execution",
      "detail": "eval/new Function/document.write in new code is a common injection sink.",
      "path": "src/auth.js",
      "line_hint": "eval(user);"
    },
    {
      "severity": "high",
      "category": "security",
      "title": "HTML injection sink",
      "detail": "Assigning untrusted data to innerHTML / dangerouslySetInnerHTML can enable XSS.",
      "path": "src/auth.js",
      "line_hint": "element.innerHTML = pass;"
    }
  ],
  "stats": {
    "files": 1,
    "file_paths": [
      "src/auth.js"
    ],
    "additions": 5,
    "deletions": 0,
    "finding_count": 5
  },
  "engine": "heuristic",
  "demo": true,
  "credits_consumed": 0,
  "sample_diff_excerpt": "diff --git a/src/auth.js b/src/auth.js\nindex 111..222 100644\n--- a/src/auth.js\n+++ b/src/auth.js\n@@ -10,6 +10,12 @@ export function login(user, pass) {\n   const q = \"SELECT * FROM users WHERE name='\" + user + \"'\";\n+  // TODO: move secret to vault\n+  const apiKey = \"sk-live-EXAMPLE_DO_NOT_USE_IN_PROD\";\n+  console.log(\"login attempt\", user, pass);\n+  eval(user);\n+  element.innerHTML = pass;\n   retur",
  "meta": {
    "service": "amoeba-judge",
    "product": "diff-review",
    "price_usdc": 0.1,
    "note": "Free demo — does not consume credits. Paid path: POST /v1/diff-review",
    "offers": "/v1/offers"
  }
}