v3.1.28

• VG010 now catches two-step SQL injection: queries built into a variable (or returned) before reaching the DB sink — the classic login-bypass shape that slipped past both regex rules and taint analysis
• Validated on a labeled ground-truth set (3/3 SQLi) and 11 real-world repos (8 unchanged, new hits all genuine raw-SQL sites); LLM-prompt false-positive class eliminated by requiring the DML keyword at string start
• 7 new tests; full suite 1788 passing, self-audit PASS A 100