Asking good questions - Enclave

Research answers best when it knows exactly what you’re asking about and what a good answer looks like.

Five habits

Name the scope. Say which repository, service, finding, or CVE you mean.
Attach context. Type @ or click Add context to attach the exact assets and findings.
Say what you want back. A list, a ranking, an attack path, or a yes or no with evidence.
Ask for evidence. Ask Enclave to cite the files, assets, and findings behind each claim.
Keep one topic per session. Start a new session for a new topic.

Good vs. bad prompts

Instead of…	Try…
”Are we secure?"	"What are the five most important issues to fix in `payments-api`, ranked by exploitability, with evidence for each?"
"Check this CVE."	"Are we affected by CVE-2026-109619? List each affected service, whether it’s reachable from the internet, and the fix."
"Look at this finding.”	(with the finding attached) “Is this finding reachable from outside our VPC? Trace the path and say what would block it."
"Review our cloud."	"Which S3 buckets in our production AWS account are public, and which services write to them?"
"Fix the findings."	"Triage the open high-severity findings in `auth-service`. Mark false positives as invalid and explain each decision.”

When an answer looks wrong

Ask for the evidence. “Which file shows that?” often surfaces a wrong assumption.
Add the missing context. Attach the asset or finding Enclave should have used.
Switch the model. For hard reasoning, pick a larger model. See Choose a model.