AI code review that never takes the model's word for it

### internal/store/users.go (modified)
@@ -41,6 +41,7 @@ func (s *Store) FindUser(ctx context.Context, name string) (*User, error) {
41 41       if name == "" {
42 42           return nil, ErrEmptyName
43 43       }
44    -     row := s.db.QueryRowContext(ctx, "SELECT id, name FROM users WHERE name = $1", name)
   44 +     q := "SELECT id, name FROM users WHERE name = '" + name + "'"
   45 +     row := s.db.QueryRowContext(ctx, q)
45 46       var u User
46 47       return &u, row.Scan(&u.ID, &u.Name)

{
  "summary": "FindUser now builds its SQL by string concatenation instead of a bound parameter.",
  "risk_score": 92,
  "findings": [
    {
      "file": "internal/store/users.go",
      "start_line": 44,
      "end_line": 45,
      "severity": "Critical",
      "category": "Security",
      "title": "SQL injection via string-built query",
      "body": "name is concatenated into the query, so a name like ' OR '1'='1 returns arbitrary rows. The previous version bound it as $1.",
      "suggestion": "row := s.db.QueryRowContext(ctx, \"SELECT id, name FROM users WHERE name = $1\", name)"
    }
  ]
}