SEV-1: blocks launch
User input may be pasted into a SQL query
What goes wrong
Someone types a crafted value into a form and your database runs it as a command.
How to fix it
Use a parameterised query. Pass values as parameters and never build SQL with template strings.
Check your app
npx sigshipRun it in your project. It reports this check as sql-string-concat, along with 16 others. Nothing leaves your machine.