#api

Unsanitized sort column enables SQL injection

Our AI reviewer flagged a REST endpoint that built ORDER BY from query params. The team assumed Prisma parameterized everything — but raw fragments bypassed that.