plan -> ['src/app.py', 'src/utils.py']
fan_out -> {'src/app.py': 4, 'src/utils.py': 1}
verify (attempt 1) -> {'approved': True, 'reason': 'Every finding includes a specific file:line citation (app.py:5, app.py:11, app.py:9, utils.py:13, app.py:2), and items are ordered by descending severity (High, High, then Low, Low, Low), satisfying both review criteria.'}

REPORT:
## Code Review — Prioritized

- 🔴 **[High] `src/app.py:5`** — Hardcoded live API key/secret in source. Rotate the key immediately and load it via environment variables/secret manager instead.
- 🔴 **[High] `src/app.py:11`** — SQL injection via f-string interpolation of `name` into query. Use a parameterized query: `conn.execute("SELECT * FROM users WHERE name = ?", (name,))`.
- 🟡 **[Low] `src/app.py:9`** — DB connection isn't closed on exception (no try/finally or context manager), causing connection leaks on error paths.
- 🟡 **[Low] `src/utils.py:13`** — `user.get("name", "").upper()` crashes with `AttributeError` if `name` is explicitly `None` (default only covers missing key). Use `(user.get("name") or "").upper()`.
- 🟢 **[Low] `src/app.py:2`** — Unused import `get_user_name`; remove for cleanliness.

**Summary:** 2 high-severity security issues demand immediate action (secret rotation + parameterized queries); the remaining items are minor robustness/cleanup fixes.

TRACE:
  plan: success, 3 turns, $0.0974
  worker[src/utils.py]: success, 3 turns, $0.0932
  worker[src/app.py]: success, 4 turns, $0.1011
  synthesize: success, 1 turns, $0.0061
  verify: success, 2 turns, $0.0095
TOTAL COST: $0.3072