An AI-generated login endpoint "works" - I still found SQL concatenation before launch

Functional tests passing is not the same as code being safe to ship. Here is a reproducible case: an AI-generated login endpoint that behaves correctly, the scan finding I checked before launch, and the fix that made the pattern disappear. The code runs, but I would not ship it like this This is a local demo equivalent of a login endpoint, not live production code and not a client project: username = request . form . get ( " username " , "" ) password = request . form . get ( " password " , "" ) sql = f " SELECT id FROM users WHERE username = ' { username } ' AND password = ' { password } '" cursor . execute ( sql ) row = cursor . fetchone () if row : return { " ok " : True } return { " ok " : False }, 401 It works: correct credentials return success. My concern is not whether it works today. It is that username and password come from an HTTP request and are placed directly inside an SQL string. A first-pass scan finds the pattern to check I did not read every line first. I ran a local quick scan: code-audit app --format html --output report.html One result was: Severity Rule Risk Location High sql-concat SQL assembled from strings, user input can reach the query app/login.py:12 A high finding is not an automatic conclusion. I confirm it in four steps. 1. Where does the input come from? username and password come from request.form . That means a client can submit arbitrary values. Input from HTTP requests is untrusted by default. 2. Where does it go? The values skip length checks, type checks, escaping and parameterization, then enter the SQL template: sql = f " SELECT id FROM users WHERE username = ' { username } ' AND password = ' { password } '" cursor . execute ( sql ) The source is a request parameter. The sink is SQL execution. There is no boundary between them. 3. Can it be exploited? I do not attack my own project. I reason through SQL syntax: If username contains: ' OR '1'='1 the resulting SQL can become: SELECT id FROM users WHERE username = '' OR '1' = '1