Test: QUA-184 security issue detection

[Desperado]

Test PR with hardcoded credentials and SQL injection to verify QUA-184 diff analysis gate.

[github-actions]

✅ Playwright Test Results

Metric	Value
Status	Passed
Passed	10
Failed	0
Skipped	0
Total	10
Browser	Chromium

---

📄 View Workflow Run

_{Powered by QualityMax}

[qualitymaxapp]

❌ QualityMax Diff Analysis — BLOCK

Critical security issues: hardcoded production credentials and SQL injection vulnerability.

Severity	Category	File	Description	Suggestion
🔴 critical	security	config.py:8	Hardcoded production database password exposed in source code	Use environment variables: DB_PASSWORD = os.getenv('DB_PASSWORD'). Never commit credentials to version control.
🔴 critical	security	config.py:9	Hardcoded production API token exposed in source code	Use environment variables: API_TOKEN = os.getenv('API_TOKEN'). Rotate this token immediately.
🔴 critical	security	config.py:19	SQL injection vulnerability: user_input is directly interpolated into SQL query without parameterization	Use parameterized queries: cursor.execute('SELECT * FROM users WHERE name = %s', (user_input,))

_{Analyzed commit b23dff74 with claude-haiku-4-5-20251001 (1 files, 882 tokens)}