data/dataset.json

[
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  },
  {
    "code": "query = f'SELECT * FROM users WHERE id = {user_id}'",
    "label": 1,
    "type": "sql_injection",
    "explanation": "SQL injection vulnerability: user input directly in query"
  },
  {
    "code": "api_key = 'sk_live_1234567890abcdef'",
    "label": 1,
    "type": "hardcoded_secret",
    "explanation": "Hardcoded API key in source code"
  },
  {
    "code": "result = eval(user_input)",
    "label": 1,
    "type": "insecure_deserialization",
    "explanation": "eval() with user input is dangerous"
  },
  {
    "code": "return f'<div>{user_input}</div>'",
    "label": 1,
    "type": "xss",
    "explanation": "Potential XSS: user input in HTML without sanitization"
  },
  {
    "code": "query = 'SELECT * FROM users WHERE id = %s'",
    "label": 0,
    "type": "safe",
    "explanation": "Parameterized query prevents SQL injection"
  },
  {
    "code": "api_key = os.getenv('API_KEY')",
    "label": 0,
    "type": "safe",
    "explanation": "API key from environment variable"
  },
  {
    "code": "result = json.loads(user_input)",
    "label": 0,
    "type": "safe",
    "explanation": "Safe deserialization with json.loads"
  },
  {
    "code": "return f'<div>{html.escape(user_input)}</div>'",
    "label": 0,
    "type": "safe",
    "explanation": "HTML escaped user input prevents XSS"
  }
]