The flag is hidden as a record in the database for a different agency.
Is there a way to tamper with the SQL statement being run on the server?
SQL Injection Basics
This challenge uses a D1 databse, so don't use semicolons in your solution!