{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/keep-secrets-out-of-the-system-prompt",
  "id": "MHC-D-RESEARCH-0314",
  "version": "0.1.0",
  "title": "Keep secrets out of the system prompt",
  "summary": "A prompt is a poor vault, even when nobody intends to show it.",
  "kind": "checklist",
  "body": "Do not embed API keys, passwords, connection strings or reusable tokens in model instructions. Store secrets in the appropriate secret-management layer and let controlled code inject only the capability or short-lived credential required for the action. Design as if prompt wording may eventually be observed.",
  "limits": [
    "Removing secrets from prompts does not secure badly scoped tools or downstream identities."
  ],
  "topics": [
    "union-ai-agent-control"
  ],
  "intents": [],
  "source_ids": [
    "RS-A650FC1839E382FF"
  ],
  "evidence": [
    {
      "claim": "OWASP states that sensitive data such as credentials and connection strings should not be stored in system prompts.",
      "source_id": "RS-A650FC1839E382FF",
      "role": "supports",
      "note": "Secrets also require appropriate storage, rotation, scoping and access controls outside the model.",
      "locator": "Separate Sensitive Data from System Prompts"
    }
  ],
  "use_when": [
    "A prompt or agent configuration is being used to connect models with protected systems."
  ],
  "avoid_when": [
    "Removing secrets from prompts does not secure badly scoped tools or downstream identities."
  ],
  "example": "The agent receives a `search_customer` tool, not the database password that makes the tool possible.",
  "check": "A copy of the full system prompt contains no credential that grants independent access.",
  "checklist": [
    "No reusable credentials appear in model-visible instructions.",
    "Secrets are retrieved by controlled code rather than generated or remembered by the model.",
    "Credentials are scoped and short-lived where the surrounding system supports it.",
    "Prompt disclosure would reveal wording, not a reusable secret."
  ],
  "sources": [
    {
      "id": "RS-A650FC1839E382FF",
      "title": "LLM07:2025 System Prompt Leakage",
      "url": "https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0314",
      "to": "MHC-D-RESEARCH-0315",
      "type": "useful_with",
      "url": "/knowledge/enforce-permissions-outside-the-model"
    }
  ],
  "collections": [
    {
      "id": "RC-EEF5F4530C11FD17",
      "title": "Let AI do useful work without giving it accidental authority",
      "url": "/collections/let-ai-do-useful-work-without-giving-it-accidental-authority"
    }
  ]
}