A stranger asked if I'd tested for prompt injection. They were right to ask
patch-security.com