## Background Need to audit all database queries to ensure SQL injection is not possible. - No systematic SQL injection prevention - Raw queries possibly used - Parameter escaping not verified - No automated scanning ## Acceptance Criteria - [ ] Audit all database queries completed - [ ] Raw queries replaced with parametrized queries - [ ] TypeORM best practices enforced - [ ] SQLMap scanning in CI optional - [ ] Security tests for injection vectors - [ ] Query builder usage documented
Background
Need to audit all database queries to ensure SQL injection is not possible.
Acceptance Criteria