{"success": true, "query_executed": "{'is_hidden': False}", "result_count": 5, "products": [{"id": "1", "name": "Laptop Pro", "category": "electronics", "price": 1299.99, "stock": 50, "is_hidden": false}, {"id": "2", "name": "Wireless Mouse", "category": "electronics", "price": 29.99, "stock": 200, "is_hidden": false}, {"id": "3", "name": "USB-C Cable", "category": "accessories", "price": 12.99, "stock": 500, "is_hidden": false}, {"id": "6", "name": "Mechanical Keyboard", "category": "electronics", "price": 149.99, "stock": 75, "is_hidden": false}, {"id": "7", "name": "Monitor Stand", "category": "accessories", "price": 49.99, "stock": 120, "is_hidden": false}], "response_metadata": {"owasp": "A03:2021 - Injection", "cwe": "CWE-943", "type": "NoSQL Injection via GET Parameters"}, "debug_notes": ["Query parameters are parsed as JSON, allowing operator injection", "Try: category={\"$ne\":\"\"}  to bypass category filter", "Try: category={\"$regex\":\".*\"}  for regex injection", "Try: show_hidden=true  to view hidden products", "Try: name={\"$regex\":\"Admin\"}  to find admin products"]}