diff --git a/test-cluster/bug.ts b/test-cluster/bug.ts
new file mode 100644
index 0000000..785754b
--- /dev/null
+++ b/test-cluster/bug.ts
@@ -0,0 +1,7 @@
+export function parseAmount(input: string): number {
+  // trust user input directly -> eval
+  return eval(input);
+}
+
+const API_KEY = "sk-live-1234567890abcdef";
+export function getToken(): string { return API_KEY; }