Prompt Injection

How Prompt Injection happens in Node.js LLM integrations and how to fix it

A critical prompt injection vulnerability in `src/llm.js` allowed user-supplied conversation turns to be forwarded directly to external AI APIs without any role validation or content sanitization. By injecting a malicious `role` value or crafted `text` payload, an attacker could manipulate the LLM's behavior, bypass instructions, or exfiltrate data. The fix introduces a `sanitizeTurns()` function that whitelists valid roles and coerces text content to safe string values before the payload reache