
fallback-secrets: 5 seeds, 3 examples
  ok   Python: Environment variable with fallback
  ok   JavaScript: Logical OR fallback
  ok   Ruby: fetch with default

default-credentials: 6 seeds, 3 examples
  ok   Hardcoded admin account
  via  API key in code: caught by fallback-secrets
  ok   Database connection string

fail-open-security: 5 seeds, 3 examples
  ok   Authentication disabled by default
  via  CORS allows all origins: caught by fallback-secrets, permissive-access
  via  Debug mode enabled by default: caught by fallback-secrets, debug-features

weak-crypto: 7 seeds, 3 examples
  GAP  MD5 for password hashing: NO SEED IN ANY CATEGORY MATCHES THIS
  ok   DES encryption for sensitive data
  ok   SHA1 for signature verification

permissive-access: 7 seeds, 3 examples
  ok   File permissions world-writable
  ok   S3 bucket public by default
  ok   API allows any origin

debug-features: 7 seeds, 3 examples
  ok   Stack traces in API responses
  ok   GraphQL introspection enabled
  ok   Verbose error messages

6 categories, 18 documented examples
3 matched only by a sibling category (acceptable, dedup keys on category)
1 matched by no seed at all
