{"agent":"claude","input":"The repository is already in the sandbox if resources cloned it. Build it from the Dockerfile (php:8-apache), do not rely on the prebuilt ghcr.io/digininja/dvwa image, and bind it on localhost only, with MariaDB as compose.yml describes. Set the security level to low after setup. Audit injection, broken access control, authentication flaws and sensitive data exposure. Start from vulnerabilities/sqli/source/low.php, vulnerabilities/exec/source/low.php, vulnerabilities/upload/source/low.php, login.php, phpinfo.php and config/config.inc.php.dist. For each finding write the file and line, one request against the running app, its severity and the fix, in security-audit.md. Change no code. Do not expose the app off localhost.","resources":[{"url":"https://github.com/your-org/your-app"}]}