Add security findings prompt to generic prompts article (#8921)

* Add security findings prompt to generic prompts article

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T8UxcJb73BsQ1MNudFftW3

* Update generic-prompts.md

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: pubkey

docs-src/docs/articles/generic-prompts.md

@@ -87,6 +87,24 @@ Add the improvement to the changelog.
 
 ## Security
 
+### Find and fix a security issue
+
+Agents tend to report theoretical security problems that no attacker can trigger in practice. This prompt forces the agent to prove each finding with a reproduction before it is allowed to fix anything.
+
+```txt
+Do a security review of FEATURE_NAME and make a list of possible security findings, ranked by severity.
+For each finding explain how an attacker could exploit it in practice.
+Findings that require the attacker to already run arbitrary code inside of the same process do not count.
+Pick the most severe finding and write a test case that reproduces the problem.
+In the test case you can only use the public API.
+First run the test case without a fix and show me the output. Then apply a fix and run the test case again and show me the output.
+
+- Ensure all other tests run successful.
+- Do not add new dependencies as part of the fix.
+- Add the fix to the changelog.
+- Ensure the linting is ok.
+```
+
 ## SEO
 
 -------------