/**
 * XSS & Prompt Injection Module
 *
 * Categories: xss, ai_prompt_injection
 * Contains semantic distinction between XSS and prompt injection.
 */

export const XSS_PROMPT_MODULE = `
### XSS vs Prompt Injection
Keep these SEPARATE:
- **XSS**: Writing untrusted data into DOM/HTML sinks without escaping
  - innerHTML with dynamic user data: flag as XSS
  - React JSX {variable}: NOT XSS (auto-escaped)
  - dangerouslySetInnerHTML with static content: info severity
- **Prompt Injection**: User content in LLM prompts
  - NOT XSS - different threat model
  - Downgrade to low/info unless clear path to high-impact actions
  - Never label prompt issues as XSS
`
