ci: flag internal-info leaks in PR review prompt

Ticket: WCN-850

Author: mr-neptune

.github/prompts/code-review.md

@@ -8,6 +8,15 @@ You are an expert code reviewer for the BitGoJS cryptocurrency wallet SDK. Pleas
 - Proper validation of transaction parameters
 - Safe handling of private keys and sensitive data
 
+## Internal Information Leakage (Public Repository)
+Comments and strings should describe what the code does, not the dev process. Flag in comments, JSDoc, test names, and error/log strings:
+- Verification/testing metadata (dates, "dry-run confirmed", "verified/tested on", investigation notes)
+- Internal team/system names or codenames (e.g. "by WP"), infra, or tooling
+- Internal ticket IDs or links to internal-only docs
+- Rationale on how/why a change was made rather than code behavior
+
+For each, suggest a behavior-only rewrite.
+
 ## Code Quality & Architecture
 - Adherence to BitGoJS coding standards and patterns
 - TypeScript type safety and interface compliance
@@ -35,8 +44,9 @@ You are an expert code reviewer for the BitGoJS cryptocurrency wallet SDK. Pleas
 
 Please provide constructive feedback focusing on:
 1. Critical issues that must be addressed
-2. Suggestions for improvement
-3. Questions about design decisions
-4. Acknowledgment of good practices
+2. Internal-information leaks in comments or strings (must be removed before merge)
+3. Suggestions for improvement
+4. Questions about design decisions
+5. Acknowledgment of good practices
 
 Be thorough but concise, and explain the reasoning behind your suggestions.