Your platform team is onboarding a new microservices monorepo. Leadership asks you to clearly delineate which GitHub Advanced Security suite is responsible for each of three concerns: (1) detecting a hardcoded AWS access key committed to source, (2) flagging a known CVE in a third-party npm package the repo depends on, and (3) identifying an SQL injection sink in application code. Which mapping correctly assigns each concern to the appropriate suite?