[
  {
    "bugId": "BUG-1",
    "severity": "Critical",
    "category": "security",
    "file": "src/example.ts",
    "lines": "12-16",
    "evidence": "src/example.ts:12-16 unvalidated body flows into exec().",
    "runtimeTrigger": "POST /api/example with body {\"command\":\"rm -rf /\"}",
    "crossReferences": ["src/router.ts:8-14"],
    "confidenceScore": 92
  }
]