Inspect representative JS 1.0 cases

25 of 25 model runs reported the SQL-shaped decoy.The helper logs a string and returns an empty array; it never sends the constructed query to a database.

function dbQuery(sql) {
  console.log("Query:", sql);
  return [];
}

This is the kind of vulnerability-shaped pattern an LLM can describe plausibly even when the required execution sink is absent.

25 of 25 model runs reported the likely SQL injection gap.Unlike Tigerteam, this helper concatenates an identifier into an executable SQLite statement.

deleteTodo: (id) =>
  db.prepare("DELETE FROM todos WHERE id = " + id).all()

It remained unmatched because it was outside the Snyk Code reference set. That status should trigger investigation, not automatic dismissal.

Claude Opus 4.6 High held a stable 40.0% Snyk-reference F1 while missing15 of 15 path-traversal opportunitiesand 10 of 15 resource-limit opportunities.

The model recognized representative high-signal issues but did not enumerate repeated vulnerable sinks as systematically as deterministic SAST.