LLM application security review

Reviews code that calls models for the OWASP Top 10 for LLM applications: prompt injection, output handling, excessive agency, unbounded consumption.

V1039 technique

not detectable from CI configuration

Sub-techniques

ID	Name	Description
`V1039.001`	Static review of LLM call sites	Check how untrusted text reaches prompts and how outputs reach tools or HTML.
`V1039.002`	Red-team probing	Send adversarial prompts to a running application and score the responses.
`V1039.003`	Runtime input and output scanning	Scan prompts and responses in production for injection and leakage.

List every place untrusted text enters a prompt and every place model output is executed or rendered.
Run a red-team suite against those paths in CI.
Cap tokens, tool calls and spend per request.

Signs that a codebase already runs this technique, and where to read how it is configured.

promptfoo or garak config, prompt templates, and tool definitions in the repository.