curl -X GET "https://api.heimdall.dev/api/scans/550e8400-e29b-41d4-a716-446655440000/findings?severity=critical&page=1&per_page=10" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

{
  "success": true,
  "data": {
    "items": [
      {
        "id": "3f7a8b9c-0d1e-2f3a-4b5c-6d7e8f9a0b1c",
        "scan_id": "550e8400-e29b-41d4-a716-446655440000",
        "repo_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
        "source": "ai",
        "status": "open",
        "severity": "critical",
        "confidence": "high",
        "title": "SQL Injection in user authentication",
        "description": "User input is directly concatenated into SQL query without sanitization",
        "cwe_id": "CWE-89",
        "cve_id": null,
        "file_path": "src/auth/login.rs",
        "line_start": 42,
        "line_end": 45,
        "code_snippet": "let query = format!(\"SELECT * FROM users WHERE email = '{}'\", email);",
        "suggested_patch": "Use parameterized queries: sqlx::query!(\"SELECT * FROM users WHERE email = $1\", email)",
        "poc_exploit_json": {
          "payload": "' OR '1'='1",
          "description": "Authentication bypass via boolean injection"
        },
        "poc_validated": true,
        "fingerprint": "abc123def456",
        "agent_reasoning": "Direct string concatenation in SQL query creates SQL injection vulnerability",
        "created_at": "2026-03-12T10:05:23Z",
        "updated_at": "2026-03-12T10:05:23Z"
      }
    ],
    "total": 5,
    "page": 1,
    "per_page": 10,
    "total_pages": 1
  }
}