SAST detection methodology for SQL injection (CWE-89), including second-order, blind boolean/time-based, ORM raw-query leaks, and JSON/JSONB-path injection. Use when reviewing code that builds or executes SQL against a relational database. Writes confirmed findings to findings/01-sql-injection.md.
