{"agent":"claude","input":"Clone https://github.com/WebGoat/WebGoat and run it in the sandbox: install JDK 25, build with ./mvnw, start the JAR (WebGoat is served at /WebGoat on port 8080) and register an account to sign in. Audit it for injection, broken access control, authentication flaws and sensitive data exposure. For each finding write the file and line, one request that demonstrates it against the running app, its severity and the fix, in security-audit.md. Change no code and open no pull request."}