{"service":"vulnerable-api","endpoints":["POST /auth/login    (weak JWT)","GET  /users/:id     (IDOR, mass assignment)","GET  /admin         (missing authz)","GET  /debug/env     (env var leakage)","GET  /debug/info    (version info)"]}