Prompts for Developers: Code, Data and Content

Code generation

Write a Flask route POST /api/notes that saves a note for the logged-in user.

Context:
- Flask 3, SQLAlchemy 2, Flask-Login, CSRF via Flask-WTF.
- Model: Note(id, user_id, text, created_at).
Requirements:
- Validate text: required, max 2,000 characters; return 400 JSON on error.
- Return 201 with {"id", "text", "created_at"}.
- Include a pytest test for success and for the 400 case.

Name versions and libraries; models default to whatever was most common in their training data, which may be outdated.

Code review

Review this diff as a senior engineer. Report only real problems, ordered by
severity: bugs, security issues (injection, auth, secrets), data loss, then
performance. For each: file and line, why it is a problem, and a concrete fix.
Do not comment on style.

Data extraction

Extract every invoice from the text below into JSON objects with fields:
invoice_number (string), date (YYYY-MM-DD), total (number), currency (ISO code).
If a field is missing, use null. Do not guess values.

Writing and marketing

Provide the brand voice with a short sample of existing copy, the audience, the single goal of the piece and words to avoid. Ask for two or three variations to choose from.

Customer support assistants

You answer questions about PandaDev's pricing and services using the FAQ below.
If the answer is not in the FAQ, say you will pass the question to the team and
ask for the customer's email. Never promise discounts or delivery dates.
<faq>...</faq>

Prompt injection: treat outside text as data

If your app feeds user content or web pages into a prompt, that text may contain instructions ("ignore previous instructions and…"). Defences:

• Mark untrusted content clearly in tags and tell the model it is data to analyse, not instructions to follow.
• Never give the model tools or permissions beyond what the task needs.
• Validate outputs before acting on them (for example, never execute generated SQL directly against production).

Exercise

Write a code-review prompt template for your own projects that includes your stack, your conventions and a severity format. Use it on a real diff and refine it twice based on what it missed.

Check yourself

• Why name library versions in coding prompts?
• What is prompt injection, and how do you reduce its risk?
• What should a support-bot prompt say about unknown answers?