diff --git a/examples/demo-app/src/app/api/auth/login/route.ts b/examples/demo-app/src/app/api/auth/login/route.ts
new file mode 100644
index 0000000..7c2ca53
--- /dev/null
+++ b/examples/demo-app/src/app/api/auth/login/route.ts
@@ -0,0 +1,17 @@
+import { db } from '../../../../lib/db';
+
+export async function POST(req: Request) {
+  const body = await req.json();
+  const username = body.username;
+
+  // Unescaped dynamic SQL query
+  const result = await db.query(`SELECT * FROM users WHERE username = '${username}'`);
+  const user = result.rows[0];
+
+  // Leaks passwordHash in response
+  return Response.json({
+    success: true,
+    user,
+    passwordHash: user ? user.passwordHash : null
+  });
+}