Checklist
Keep secrets out of the system prompt
A prompt is a poor vault, even when nobody intends to show it.
When it fits
- A prompt or agent configuration is being used to connect models with protected systems.
When to avoid it
- Removing secrets from prompts does not secure badly scoped tools or downstream identities.
Checklist
- No reusable credentials appear in model-visible instructions.
- Secrets are retrieved by controlled code rather than generated or remembered by the model.
- Credentials are scoped and short-lived where the surrounding system supports it.
- Prompt disclosure would reveal wording, not a reusable secret.
Why it matters
Do not embed API keys, passwords, connection strings or reusable tokens in model instructions. Store secrets in the appropriate secret-management layer and let controlled code inject only the capability or short-lived credential required for the action. Design as if prompt wording may eventually be observed.
An example
The agent receives a `search_customer` tool, not the database password that makes the tool possible.
Check your result
A copy of the full system prompt contains no credential that grants independent access.
Keep this limit in mind
- Removing secrets from prompts does not secure badly scoped tools or downstream identities.
Connected ideas
Useful withEnforce permissions outside the model
Evidence and sources
Supports
OWASP states that sensitive data such as credentials and connection strings should not be stored in system prompts.
Secrets also require appropriate storage, rotation, scoping and access controls outside the model.
LLM07:2025 System Prompt Leakage · Separate Sensitive Data from System Prompts