Apply security guidelines when designing, building, or reviewing AI chatbots, LLM-powered apps, autonomous/tool-using agents, and mobile apps (React Native/Expo, Flutter) — covering agent controls (authorization checks, plan validation, execution limits, audit logging), LLM/prompt security (prompt injection, RAG sanitization, output validation, PII/secret handling), OWASP web security (input validation, injection prevention, auth, headers, rate limiting), and mobile security (secure on-device storage, API key handling, certificate pinning, deep links, biometric auth). Use this any time the user writes system prompts, tool definitions, agent orchestration, RAG pipelines, chatbot backends, or mobile app auth/storage code, or asks for a security review or audit — even without saying "security" explicitly (e.g. "let the agent call other agents", "store the auth token in the app", "add a deep link to checkout").
2026-07-15