When generating code that handles user input, authentication, or data storage, use a security-focused persona:
"Before writing any code, identify potential injection points. Consider authentication boundaries. Flag any hardcoded secrets. Use parameterized queries for all database operations. Then implement the feature."
This front-loads security thinking instead of bolting it on later.