{"target_commit": "7f244ec", "planted": [
 {"id": "P1", "class": "SQL injection", "function": "search_notes", "file": "app/server.py", "lines": [20, 23]},
 {"id": "P2", "class": "Path traversal / arbitrary file read", "function": "read_attachment", "file": "app/server.py", "lines": [38, 41]},
 {"id": "P3", "class": "Missing ownership check (IDOR) on delete", "function": "delete_note", "file": "app/server.py", "lines": [32, 35, 82]}],
 "decoys": [{"function": "get_note", "lines": [26, 29]}, {"function": "read_avatar", "lines": [44, 49]}]}