In `@vul.py` around lines 13 - 16, The file defines a hardcoded API_KEY and should
be protected from accidental production import; add a module-level import guard
at the top (before API_KEY and app/Flask usage) that checks for test runners
(e.g., presence of "pytest" or "unittest" in sys.modules) and raises ImportError
if not running under tests, so the module can only be imported in test
environments and will fail fast otherwise; update references around API_KEY and
app (Flask(__name__)) to ensure the guard runs first.

In `@vul.py` around lines 19 - 21, The file is misnamed—rename vul.py to
vuln_examples.py and replace the unsafe os.system call inside function
list_files(user_path) with a safe os.listdir(user_path) implementation; before
calling os.listdir, validate and normalize user_path (e.g., use os.path.abspath
and ensure it is under an allowed base directory or matches an allowlist) and
raise or return an error for invalid/unauthorized paths, then return the
directory listing rather than executing shell commands.

In `@vul.py` around lines 24 - 30, The get_user function is vulnerable to SQL
injection and leaks the DB connection; fix it by using a context manager for the
connection and a parameterized query: open the DB with "with sqlite3.connect(...
) as conn", obtain a cursor from conn, execute the query using a placeholder
(e.g., "SELECT * FROM users WHERE username = ?") with (username,) as parameters,
fetch and return results so the connection is closed automatically; update
references to get_user accordingly.

In `@vul.py` around lines 38 - 41, The read_file function concatenates "uploads/"
with the user-supplied filename and is vulnerable to path traversal; change it
to resolve the filename against a fixed base uploads directory (use pathlib.Path
or os.path.realpath) and then verify the resolved path is inside that base
(e.g., compare resolved_path.commonpath/base or
resolved_path.startswith(base_resolved)); if the check fails, raise an error and
do not open the file. Ensure all references in read_file use the resolved,
validated path.

In `@vul.py` around lines 44 - 46, The fetch_url function currently accepts
arbitrary URLs and calls requests.get without validation or timeout; update
fetch_url to (1) parse the URL (use urllib.parse) and reject non-http/https
schemes, (2) resolve the hostname to IP(s) (use socket.getaddrinfo) and refuse
any private/reserved addresses (RFC1918, IPv6 unique/local, loopback,
link-local), (3) optionally enforce a host allowlist or denylist, and (4) call
requests.get with a sensible timeout and raise or return a controlled error on
validation failures or timeouts; reference the fetch_url function when making
these changes.

In `@vul.py` around lines 49 - 51, The calculate function currently calls
eval(expression) which is unsafe; replace it with a safe evaluator by parsing
and evaluating only allowed expressions — for simple literals use
ast.literal_eval from the ast module (import ast and call
ast.literal_eval(expression) in calculate) or, for arithmetic expressions,
integrate a vetted math-expression parser/evaluator (e.g., use the simpleeval or
numexpr library or implement a whitelist AST walker that only permits BinOp,
Num/Constant, UnaryOp, and supported operators) and have calculate call that
safe evaluator instead of eval; update any tests to reflect the new behavior.

In `@vul.py` around lines 54 - 56, The hash_password function currently uses MD5
which is insecure; replace its implementation to use a modern slow KDF
(recommend bcrypt or argon2) that generates per-password salts and stores the
algorithm+parameters in the hash string, and update any corresponding
verification function (e.g., verify_password / check_password) to use the
matching library's verify/check routine (bcrypt.checkpw or argon2.verify)
instead of comparing MD5 digests; ensure you choose/configure a reasonable cost
factor, produce output in a self-describing format (e.g., "$bcrypt$..."), and
migrate or mark existing MD5 hashes so authentication can re-hash on next login.

In `@vul.py` around lines 59 - 63, The /debug endpoint exposing debug() should be
removed or replaced: delete the `@app.route`("/debug") handler and the debug()
function that calls os.popen(cmd). If you need equivalent admin tooling,
implement an authenticated admin-only endpoint (verify admin
session/credentials) and avoid executing shell commands from user input—use
safe, explicit server-side operations or vetted library calls instead of
os.popen(cmd). Ensure no remaining references to debug() or os.popen(cmd) remain
in vul.py.

In `@vul.py` around lines 66 - 71, The function divide currently uses a bare
except which hides all errors; update divide to catch specific exceptions (e.g.,
catch ZeroDivisionError and return None) and do not swallow other
exceptions—either let them propagate or re-raise them so calling code can see
real failures; locate the divide function and replace the bare except with an
explicit except ZeroDivisionError (and optionally an except TypeError if you
want to handle non-numeric inputs) while ensuring other exceptions are not
caught silently.

In `@vul.py` around lines 44 - 45, The load_session function currently calls
pickle.loads on input data which allows unsafe deserialization; replace this
with a safe parser such as json.loads or a verified/signed deserializer and
reject raw pickle input. Update the load_session implementation to (1) detect
and refuse pickle-serialized blobs, (2) parse the session using json.loads (or a
signed serializer API) and validate required session fields, and (3) raise a
clear exception on malformed/untrusted data so no direct pickle.loads call
remains in load_session.

In `@vul.py` around lines 75 - 77, The app currently calls app.run(host="0.0.0.0",
port=5000, debug=True) in the if __name__ == "__main__" block which exposes the
Flask debugger publicly; change this to default to host="127.0.0.1" and set
debug from an environment flag (e.g., os.environ.get("FLASK_DEBUG") == "1" or
similar) so debug=True is only enabled when explicitly allowed, and ensure any
allowlist for host binding is enforced before calling app.run; update the
app.run invocation and gating logic around __main__ accordingly.