update

app.py

@@ -350,7 +350,8 @@ def enrich_ioc(ioc, ioc_type):
     label = {"ip": "IP Addresses", "domain": "Domains", "url": "URLs", "file": "File Hashes"}.get(ioc_type, "Indicators")
     # Only live feed data goes in the report — no canned recommendation (the model writes the analysis).
     return ("Analyze this threat intelligence report. Produce a structured red-team summary using only "
-            "what the report states. Do not invent actors, malware, or indicators.\n\n"
+            "what the report states. Do not invent actors, malware, indicators, or recommendations; "
+            "omit any line the record does not support.\n\n"
             "[Threat Report]\n"
             f"Title: Live IOC enrichment — {ioc}\n\n"
             f"{' '.join(bits)}\n\n"