Find Bugs in Source Code

def login(username, password):
    # [CRITICAL] SQL Injection detected
    # User input is directly concatenated into query
    query = "SELECT * FROM users WHERE user = '" + username + "'"
    
    # Recommendation: Use parameterized queries
    # cursor.execute("SELECT * FROM users WHERE user = %s", (username,))
    
    db.execute(query)
    
    # [HIGH] Hardcoded Secret
    # Never commit secrets to version control
    api_key = "example_api_key_1234567890"