Threat-model-first security prompts. "Find all vulnerabilities" fails; a one-line threat model plus a narrow slice finds real CVEs.