| Finding | Scanner | Severity | Status |
|---|---|---|---|
| SQL injection in login form | ZAP / Semgrep | Critical | Open |
| CVE-2023-44487 HTTP/2 DoS | Trivy | Critical | Open |
| AWS key in commit history | Gitleaks | Critical | Rotated |
| Reflected XSS in search | ZAP | High | Open |
| Broken object level auth | ZAP | High | Open |