{"agent":"claude","input":"Clone https://github.com/OWASP/NodeGoat and run it in the sandbox: start MongoDB, seed it with artifacts/db-reset.js, start the server on port 4000 and sign in as an ordinary user. Audit it for injection, broken access control, authentication flaws and sensitive data exposure. For each finding write the file and line, one request that demonstrates it against the running app, its severity and the fix, in security-audit.md. Change no code and open no pull request."}