content: |
  # Parameterized Queries Only

  All database queries must use parameterized placeholders.

  - Use `?` placeholders for SQLite, `%s` for PostgreSQL
  - Never concatenate or f-string user input into SQL
  - Validate column names against allowlists
  - Use ORM methods when available

metadata:
  enforce: hard
  reason: "Blocked by security-baseline: use parameterized queries, not string concatenation"
  matches:
    - tool: write_file
      pattern: "f[\"']\\s*SELECT|f[\"']\\s*INSERT|f[\"']\\s*UPDATE|f[\"']\\s*DELETE"
    - tool: edit_file
      pattern: "f[\"']\\s*SELECT|f[\"']\\s*INSERT|f[\"']\\s*UPDATE|f[\"']\\s*DELETE"
    - tool: write_file
      pattern: "\\.execute\\s*\\(\\s*f[\"']"
    - tool: edit_file
      pattern: "\\.execute\\s*\\(\\s*f[\"']"
