Raw structured_output:
{
  "findings": [
    {
      "file": "src/app.py",
      "line": 5,
      "severity": "high",
      "description": "Hardcoded live-looking API key committed directly in source code instead of loaded from environment/secret store."
    },
    {
      "file": "src/app.py",
      "line": 11,
      "severity": "high",
      "description": "SQL injection: user-controlled `name` is interpolated via f-string directly into the SQL query instead of using a parameterized query."
    }
  ],
  "total_count": 2,
  "overall_risk": "high"
}

Typed access: 2 findings, risk=high
  src/app.py:5 [high] Hardcoded live-looking API key committed directly in source code instead of loaded from environment/secret store.
  src/app.py:11 [high] SQL injection: user-controlled `name` is interpolated via f-string directly into the SQL query instead of using a parameterized query.