Anatomy of a review comment

### :hourglass_flowing_sand: ADO Pilot — **review queued**

Your PR is in the review queue. This comment will update when the review starts and again when it completes.

<sub>ADO Pilot · [settings](https://app.adopilot.dev/dashboard/settings)</sub>

### :gear: ADO Pilot — **review in progress**

Analyzing 14 files (+412 / −87 lines). This comment will update when the review completes.

<sub>ADO Pilot · [live progress](https://app.adopilot.dev/dashboard/reviews/{runId})</sub>

### :fast_forward: ADO Pilot — **superseded by newer push**

This review was superseded by a newer push — the new run is in progress.

<sub>ADO Pilot · [live progress](https://app.adopilot.dev/dashboard/reviews/{runId})</sub>

### :white_check_mark: ADO Pilot — **PASS** · no findings

**Summary.** Small, tightly scoped change. The accompanying test fixture update is correct. No issues found.

---

<sub>ADO Pilot v{semver} · [full review](https://app.adopilot.dev/dashboard/reviews/{runId}) · [settings](https://app.adopilot.dev/dashboard/settings) · model: {model} · took 48s · run id: `{runId}`</sub>

### :warning: ADO Pilot — **ADVISORY** · 1 warning · 1 suggestion

**Summary.** The PR introduces a login feature with no blocking issues. One error-handling warning is worth fixing before merge, one refactor is optional. Style otherwise consistent with the surrounding codebase.

- :warning: **warning · error-handling** — `src/jobs/export.ts:118`: logs and continues inside `catch`, masking upstream failures.
- :bulb: **suggestion · maintainability** — `src/utils/format.ts:8`: is duplicated across 4 callsites; one helper would DRY these up.

---

<sub>ADO Pilot v{semver} · [full review](https://app.adopilot.dev/dashboard/reviews/{runId}) · [settings](https://app.adopilot.dev/dashboard/settings) · model: {model} · took 2m 41s · run id: `{runId}`</sub>

### :x: ADO Pilot — **FAIL** · 2 blockers · 3 warnings · 1 suggestion

**Summary.** Two security blockers on the new auth paths: one SQL injection in the login handler, one reset-token leak in the password reset response. Both are reproducible with concrete fixes inline.

- :red_circle: **blocker · security** — `src/api/login.ts:42`: concatenates `email` into a raw SQL query.
- :red_circle: **blocker · security** — `src/api/reset.ts:91`: returns the reset token in the response body, leaking it past the email channel.
- :warning: **warning · error-handling** — `src/jobs/export.ts:118`: swallows rejections inside `catch`.
- :warning: **warning · error-handling** — `src/api/reset.ts:54`: does not handle the DB timeout case.
- :warning: **warning · testing** — `src/api/login.test.ts:12`: no longer covers the happy path after the refactor.

…and 1 more — see [full review](https://app.adopilot.dev/dashboard/reviews/{runId}).

---

<sub>ADO Pilot v{semver} · [full review](https://app.adopilot.dev/dashboard/reviews/{runId}) · [settings](https://app.adopilot.dev/dashboard/settings) · model: {model} · took 3m 12s · run id: `{runId}`</sub>

### :warning: ADO Pilot — **review could not complete**

We hit an error partway through and couldn't finish. You will not be billed for this run. A new review will trigger automatically on the next push, or [retry manually](https://app.adopilot.dev/dashboard/reviews/{runId}).

**Error class:** `unhandled_exception`

<sub>ADO Pilot · [diagnostics](https://app.adopilot.dev/dashboard/reviews/{runId}) · [support](https://app.adopilot.dev/support)</sub>

:red_circle: **blocker · security**

Line 42 builds the query string by concatenating the `email` variable directly into SQL text. A malicious `email` value can escape the quoting and exfiltrate or mutate other rows.

```suggestion
const user = await db.query(
  sql`SELECT * FROM users WHERE email = ${email}`,
);
```

Same pattern also appears at `src/api/reset.ts:91` — worth fixing together.