Test internal PR - XSS vulnerability

.github/workflows/promptfoo-code-scan.yml

@@ -30,7 +30,7 @@
           git checkout pr-head
 
       - name: Run Promptfoo Code Scan
-        uses: promptfoo/code-scan-action@v0
+        uses: promptfoo/code-scan-action@staging
         with:
           min-severity: medium
           api-host: https://freddy-uninvestable-jenae.ngrok-free.dev

internal-vuln-test.js

@@ -0,0 +1,11 @@
+// Internal PR test file
+const express = require('express');
+const app = express();
+
+app.get('/search', (req, res) => {
+  const term = req.query.q;
+  // XSS vulnerability - rendering unsanitized input
+  res.send(`<h1>Results for: ${term}</h1>`);
+});
+
+module.exports = app;