main
feat: insecure API — intentionally vulnerable (no auth, no validation, SQL injection, plain text passwords)
feat: secure API with 26 OWASP security measures