{"training":{"id":"T-SECRETS-1","slug":"secrets-in-prompts","title":"Secrets in prompts","policyId":"P-CREDENTIALS","minutes":3,"version":1,"lang":"en","assignment":{"happened":"On {date}, {agent} on {device} sent a prompt with {aDataClass} in it; {blocked}.","matters":"A {minutesWord} training shows why a key in a prompt counts as disclosed, what to do about this one, and how to give an agent a secret without pasting it."},"lesson":[{"id":"what-happened","heading":"What happened on {device}","body":["On {date} at {time}, {agent} on {device} sent a prompt to the model during a session: {session}. qcontrol recorded it as: {evidence}.","The policy {policy} recorded a finding. {outcome}"],"illustration":{"scene":"secret-prompt","alt":"{agent} on {device} sends a prompt with {aDataClass} in it to the model.","animated":true}},{"id":"why-disclosed","heading":"Why a key in a prompt is a key disclosed","body":["A prompt leaves your machine when you send it. The provider receives it, and it can stay in the session's transcript, in the provider's logs and in any tool the agent passed it to.","Anyone who can read one of those copies can use the key until it is revoked. A prompt cannot be called back, so the fix is to make the key useless."],"illustration":{"scene":"secret-copies","alt":"A prompt, once sent, has copies outside your machine: the transcript, the provider's logs and the tools it reached."}},{"id":"this-key","heading":"What to do about this key","body":["{keyAdvice}","Tell IT what you did and when, so they can check where the old key was used. If you do not know who owns the key, IT can find out."],"illustration":{"scene":"secret-rotate","alt":"The old key revoked, a new one issued where the tool reads it, and IT told."}},{"id":"instead","heading":"What to do instead","body":["Give the agent a reference, not the secret: keep keys in your secret manager or in environment variables, and let the tool read them when it runs.","Before you paste a file into a prompt, open it and look for keys, tokens and passwords. A .env file nearly always holds some.","qcontrol looks for {detectors} in every prompt. {detectorsOffSentence} Keeping secrets out of a prompt is still yours to do."],"illustration":{"scene":"secret-reference","alt":"The secret stays in a secret manager or an environment variable; the tool reads it when it runs, and the prompt only names it."},"instead":true}],"check":[{"id":"q-deleted","prompt":"Your prompt had a key in it, and the agent sent it. A minute later you deleted the conversation. Is the key safe now?","choices":[{"id":"a","text":"Yes, deleting the conversation removed the key"},{"id":"b","text":"No, a copy left with the prompt, and the key works until it is revoked","right":true},{"id":"c","text":"Yes, once the session has ended"}],"explain":"The prompt left your machine when it was sent; only revoking the key makes the copies harmless.","stepId":"why-disclosed"},{"id":"q-revoke","prompt":"A key you pasted reached the model. What makes that key safe again?","choices":[{"id":"a","text":"Revoke it and issue a new one","right":true},{"id":"b","text":"Delete the prompt from the agent's history"},{"id":"c","text":"Ask the agent to forget it"}],"explain":"A revoked key opens nothing, wherever a copy of it sits.","stepId":"this-key"},{"id":"q-reference","prompt":"Your agent needs a database password to run a migration. How does it get the password?","choices":[{"id":"a","text":"You paste it into the prompt and delete it afterwards"},{"id":"b","text":"You put it in a comment in the code the agent reads"},{"id":"c","text":"The tool reads it from your secret manager or an environment variable when it runs","right":true}],"explain":"The tool reads the secret when it runs, so the secret never passes through a prompt.","stepId":"instead"},{"id":"q-not-flagged","prompt":"qcontrol did not flag a prompt you sent. Does that mean the prompt had no secret in it?","choices":[{"id":"a","text":"Yes, qcontrol checks for every kind of secret"},{"id":"b","text":"No, it checks for known kinds of key, so checking what you paste is still up to you","right":true},{"id":"c","text":"Yes, if the policy is set to Observe"}],"explain":"{detectorsOffSentence} A prompt that passes the check can still hold a secret.","stepId":"instead"}],"contact":{"owner":"{owner}","how":"Contact IT from the message that brought you here, or reply to it; the replies reach {owner}."},"library":{"lesson":[{"id":"what-happened","heading":"How a key ends up in a prompt","body":["A key reaches a prompt in ordinary ways: a pasted .env file, a config snippet, or an error message that prints a connection string. The agent sends the prompt as it is.","qcontrol looks for {detectors} in every prompt from {device}. When it finds one, the policy {policy} records a finding, or stops the prompt where the policy blocks."],"illustration":{"scene":"secret-prompt","alt":"{agent} on {device} sends a prompt with {aDataClass} in it, and the model receives it.","animated":true}},{"id":"this-key","heading":"What to do if a key reached a model","body":["If a key you pasted reached a model, treat it as disclosed: revoke it and issue a new one the same day, or ask whoever owns it to.","Tell IT what you did and when, so they can check where the old key was used. If you do not know who owns the key, IT can find out."],"illustration":{"scene":"secret-rotate","alt":"The old key revoked, a new one issued where the tool reads it, and IT told."}}],"check":[]}},"version":1,"contentHash":"sha256:5c9780085bcefa460897a26f617780c8fbf841495c8787f4e6b8ec11c042f715","slots":["aDataClass","agent","blocked","date","detectors","detectorsOffSentence","device","evidence","keyAdvice","minutesWord","outcome","owner","policy","session","time"],"path":"app/data/trainings/en/secrets-in-prompts.md"}