Prompt Engineering
: The practice of designing and optimizing inputs (prompts) to large language models to achieve desired outputs. For code generation, prompt engineering involves structuring requests with clear requirements, constraints, examples, and security specifications to guide the AI toward producing correct, secure, and maintainable code.
Why It Matters for AI-Coded Apps
The quality and security of AI-generated code depends heavily on how you prompt the model. Vague prompts like ‘build a login page’ produce insecure code. Specific prompts like ‘build a login page with bcrypt password hashing, rate limiting, CSRF protection, and parameterized queries’ produce significantly more secure implementations.
Real-World Example
Poor prompt: ‘Add user authentication.’ Better prompt: ‘Add user authentication using bcrypt for password hashing with cost factor 12. Use parameterized SQL queries. Add rate limiting (5 attempts per 15 minutes per IP). Set HttpOnly, Secure, SameSite=Strict cookies. Return generic error messages that do not reveal whether an email exists.’
How to Detect and Prevent It
Always include security requirements in prompts. Specify authentication methods, input validation rules, error handling behavior, and access control requirements explicitly. Use system prompts that establish security baselines. Reference OWASP guidelines in prompts for security-critical code. Review generated code against the security requirements you specified.
Frequently Asked Questions
Does better prompting eliminate security vulnerabilities?
Better prompting significantly reduces but does not eliminate vulnerabilities. Security-focused prompts increase the likelihood of secure code from roughly 30% to 70-80%, but automated scanning and manual review are still essential. Prompting is one layer of defense, not a complete solution.
What makes a good security-focused prompt?
A good security prompt specifies: the authentication method, password handling requirements, input validation rules, output encoding requirements, authorization checks, rate limiting, error handling (no information leakage), HTTPS enforcement, and specific libraries to use for security-critical operations.
Should I use system prompts for security?
Yes. System prompts establish baseline security requirements for every interaction. Include rules like ‘always use parameterized queries,’ ’never use eval(),’ ‘always validate input server-side,’ and ‘use established security libraries.’ This creates a security floor that individual prompts can build on.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval