Function sanitizeForPrompt

server/handler_analysis.go:164–175

sanitizeForPrompt escapes user-provided text to prevent prompt injection. Wraps content in explicit data delimiters so the LLM treats it as data, not instructions.

(text string)

// sanitizeForPrompt escapes user-provided text to prevent prompt injection.
// Wraps content in explicit data delimiters so the LLM treats it as data, not instructions.
func sanitizeForPrompt(text string) string {
	if text == "" {
		return ""
	}
	// Strip common prompt injection patterns
	dangerous := []string{"<|im_start|>", "<|im_end|>", "<<SYS>>", "<</SYS>>", "[INST]", "[/INST]"}
	result := text
	for _, d := range dangerous {
		result = strings.ReplaceAll(result, d, "[FILTERED]")
	}
	return result
}

func buildAnalysisPrompt(req *pb.AnalyzeIssueRequest) string {
	var sb strings.Builder