diff --git a/backend/README_TEST.md b/backend/README_TEST.md
new file mode 100644
index 0000000..0f9069d
--- /dev/null
+++ b/backend/README_TEST.md
@@ -0,0 +1 @@
+# test change
diff --git a/backend/app/services/_demo_buggy.py b/backend/app/services/_demo_buggy.py
new file mode 100644
index 0000000..85f2b58
--- /dev/null
+++ b/backend/app/services/_demo_buggy.py
@@ -0,0 +1,22 @@
+import sqlite3
+
+API_SECRET = "sk-hardcoded-secret-12345"
+
+
+def get_user_by_name(conn: sqlite3.Connection, name: str):
+    query = "SELECT * FROM users WHERE name = '" + name + "'"
+    cursor = conn.execute(query)
+    return cursor.fetchone()
+
+
+def append_to_cache(item, cache=[]):
+    cache.append(item)
+    return cache
+
+
+def load_config(path):
+    try:
+        with open(path) as f:
+            return f.read()
+    except:
+        pass