We caught a SQL injection with an offline AI security scanner — here's the exact query it found

The bug

Here's a login endpoint from a small Express demo app

(scan-target-demo-apps/apps/01-sql-injection):

app.post('/login', (req, res) => {

const { username = '', password = '' } = req.body;