# Technical amendment — remediation guidance in the published sample artifact

**Amends:** [`assets/sample-run-report.json`](/assets/sample-run-report.json) (sha256 `33ad51abeeb5085b10003848e6606fff411a9c82e06a5f86d23a8c694aac1c11`, unchanged) · **Date:** 2026-09-06 · **Scope:** remediation prose only; findings, PoCs, metrics and verdicts are untouched.

## What is corrected and why

1. **WAL is not a SQLi mitigation.** The artifact's remediation for the login finding suggests enabling SQLite WAL/safe mode as a defense. WAL is a journaling/concurrency mechanism (sqlite.org/wal.html); it does not prevent injection. **Correct guidance:** parameterized queries (the code path must never concatenate user input into SQL), plus input validation at the API boundary.
2. **The example query was incomplete authentication.** The snippet showed a lookup by email without password verification, which could be read as replacing authentication. **Correct guidance:** parameterization is the fix for the injection; authentication must still verify credentials in constant time (hash comparison server-side). The two concerns are separate.

## Status of the original

The published artifact is preserved byte-identical (hash above) as the historical run record; this amendment is the corrected remediation guidance for readers of that record. Future runs carry reviewed remediation before publication.