[shrsv]

Adds a couple of small debugging helpers used while chasing down a prod issue last week -- useful enough to keep around.

[livereviewbot]

LiveReview automated review

Scanned 2 changed files (+12/-0).

🔴 Critical — Security (internal/debugquery.go:7): BuildLookupQuery builds a query string via raw fmt.Sprintf interpolation of key with no escaping or parameterization -- classic SQL-injection shape, even though this demo service has no real database yet. Any caller passing user-influenced input through key is exploitable the moment this is wired to a real backend.

🔴 Critical — Security (internal/debuglog.go:8): LogRequest prints the full, unredacted auth header to logs on every call. Bearer tokens, session cookies, or API keys in that header are now sitting in plaintext log output -- a second, independent critical security issue in the same diff.

[livereviewbot]

Auto-approve policy evaluation

Stage	Result
Eligibility	✅ pass
LLM classification (security-sensitive-but-confident, confidence 9)	✅ pass
Findings	2x critical / security
Risk score vs. threshold	❌ fails, decisively

Verdict: BLOCKED at the risk stage. This is the compounding check: a second independent critical/security finding must never make the risk score look safer than the single-finding case (critical-finding-in-security-blocks) -- it blocks at least as hard. More risk signal should never be rewarded.

[livereviewbot]

Auto-approve policy verdict: BLOCKED (risk stage). Two independent critical/security findings compound -- blocks at least as decisively as a single one.