diff --git a/backend/crates/infrastructure/src/trivy.rs b/backend/crates/infrastructure/src/trivy.rs
index 77aa815..f06558b 100644
--- a/backend/crates/infrastructure/src/trivy.rs
+++ b/backend/crates/infrastructure/src/trivy.rs
@@ -209,6 +209,18 @@ impl VulnerabilityScanner for FakeScanner {
                 title: "apt: unsigned repository".into(),
                 url: "https://avd.aquasec.com/nvd/cve-2011-3374".into(),
             },
+            // production-sized identifiers: long Go module path, multi-version fix list
+            RawFinding {
+                cve_id: "GHSA-hrxh-6v49-42gf".into(),
+                severity: Severity::Medium,
+                package: "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp".into(),
+                installed_version: "2:2.6.2+samba4.17.12+dfsg-0+deb12u4".into(),
+                fixed_version: Some(
+                    "3.31.6, 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f".into(),
+                ),
+                title: "otelhttp: unbounded cardinality metrics".into(),
+                url: "https://github.com/advisories/GHSA-hrxh-6v49-42gf".into(),
+            },
         ])
     }
     async fn scan_image(