Function generateCanary

browse/src/security.ts:272–275

()

 * URLs, file writes (per Codex review tension #2 — canary covers all channels).
 */
export function generateCanary(): string {
  // 12 hex chars = 48 bits of entropy, astronomically low collision.
  return `CANARY-${randomBytes(6).toString('hex').toUpperCase()}`;
}

/**
 * Append the canary instruction to a system prompt. Claude is told never to