Meridian Pay Expense Reimbursement API (vulnerable sample app)

Deliberately vulnerable Flask + SQLite API, built as a target rep for demoing an AI driven security remediation workflow.

What's here

• app.py — three endpoints: submit expense, look up by email, bulk import
• config.py — app config, includes seeded vuln #1
• requirements.txt — pins the vulnerable PyYAML version (seeded vuln #3)
• findings.json — three mock scanner alerts, shaped like real Wiz/Snyk-style findings, one per seeded vulnerability. Feed these to the agent one at a time as the "input" it triages, to simulate a real alert pipeline.