A security tool called my prompt injection safe. Its own deep mode called it critical.

Same input, two modes, two opposite verdicts, both on public receipts. The cheap path was a 21-rule regex pass with zero matches.