Well and SQL injection is still #1 security vulnerability AFAIK. Do we mark any script that can run an arbitrary SQL query as "vulnerable"? Or educate the devs

Well and SQL injection is still #1 security vulnerability AFAIK. Do we mark any script that can run an arbitrary SQL query as "vulnerable"? Or educate the devs to not concatenate strings from untrusted inputs and instead either validate the text or use named parameters? If you want powerful tools these are also dangerous. Sure we should try to make our libraries as safe as possible and pick the safer version everything being the same, but everything is not the same. "there are dozens of financial institutions running your "command execution as a service" tool open to the internet with default admin creds because they think it's a simple uptime monitor" that's 9 out of 10 on the companies' side in my experience (except for the "default admin creds", which we all know should be prompted/created on the first run).