Test fork PR scanning

[danenania]

Testing fork PR scanning with SQL injection vulnerability

[promptfoo-scanner-staging]

Code Scan

Fork PR scanning is disabled by default. To scan this PR:

• A maintainer can request a review from @promptfoo-scanner
• Or enable automatic fork scanning in your workflow:

- uses: promptfoo/code-scan-action@v1
  with:
    enable-fork-prs: true

[danenania]

@promptfoo-scanner-staging

[promptfoo-scanner-staging]

❌ Failed to trigger code scan. The workflow file promptfoo-code-scan.yml may not exist or may not have workflow_dispatch enabled.

[danenania]

@promptfoo-scanner-staging

[promptfoo-scanner-staging]

👍 All Clear

I reviewed this PR for LLM security vulnerabilities across all six vulnerability classes (Prompt Injection, Data Exfiltration, PII/Secrets in Prompts, Insecure Output Handling, Excessive Agency, and Jailbreak Risks). The code is a traditional Express.js route handler with no LLM functionality or data paths.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No} 

[danenania]

@promptfoo-scanner-staging

[promptfoo-scanner-staging]

👍 All Clear

This PR adds a test file for fork PR scanning. I reviewed the code changes and found no LLM security vulnerabilities. The code does not involve any LLM interactions, prompt construction, or agent capabilities.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No}