Implementation guide
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Secure Prompt & Context Management
No secrets in prompts
Verify that written guidance forbids putting secrets, credentials, PII, or classified data in any prompt sent to an AI tool. The guidance is enforced in pre-commit hooks, IDE integrations, and CI.
OWASP AISVS v1.01, requirement AC.3.1
In plain English
Forbid putting secrets, credentials, personal data or classified data into prompts for AI tools, and back the rule with tooling. Anything in a prompt leaves your control: it goes to the vendor, may be logged, and may be kept.
What good looks like
- The rule is written down and is part of developer onboarding.
- Enforcement exists at three points: pre-commit hooks, IDE integrations and CI.
- Violations are logged and followed up, and exposed secrets are rotated.
- The rule covers chat prompts, files attached as context and content the tool reads by itself.
How teams usually do it
- Secret scanning in pre-commit and CI, for example Gitleaks, TruffleHog or detect-secrets, and the platform's push protection.
- Ignore files and content-exclusion settings in the AI tool, so env files, key stores and data exports are never read.
- A gateway or proxy for AI traffic that scans and blocks prompts containing secrets, where the tool supports it.
Suggested evidence
- The written guidance.
- The enforcing configurations at each of the three points.
- A record of a caught violation and the rotation that followed.
Common mistakes
- A written rule with nothing enforcing it.
- Scanning commits when the leak happens in the prompt, before any commit exists.
- Removing a leaked secret from the file and not rotating it.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.