> I've found that some prompt engineering can be helpful: explicitly telling the model to generate secure code in the prompt sometimes helps. As noted in the d

> I've found that some prompt engineering can be helpful: explicitly telling the model to generate secure code in the prompt sometimes helps. As noted in the diversity of prompt section, we did try a lot of different/ reasonable changes to the prompt to see what would happen in our SQL injection scenario. In our case, asking it to make it secure actually made the prompt slightly worse (!), and the biggest bias towards making the code better was having other good code. > There isn't a single default value. That's what we also guess, but as you say, it's not written or documented anywhere.