main
feat: secure API with 26 OWASP security measures
feat: insecure API — intentionally vulnerable (no auth, no validation, SQL injection, plain text passwords)