Before committing a prompt template, remove credentials, real customer data, internal system details you would not publish, and any text copied from outside without review. Replace them with placeholders, configuration references or invented examples. A committed prompt lives in history, copies and logs for a long time.
Why prompts leak things
Prompts are written in a hurry during experiments. A developer pastes a real support ticket to see how the model responds, adds an API key to make a demo work, and describes the internal architecture so the assistant can answer questions. Then the working prompt gets committed.
Repository history is permanent in practice. Deleting a line later does not remove it from earlier commits, clones or forks. Treat anything committed as disclosed to everyone with repository access, now and later.
Checklist
| Remove | Replace with |
|---|---|
| API keys, tokens, passwords | Environment configuration read by code, never in the prompt |
| Real customer messages | Invented examples with fake names and numbers |
| Personal data of staff | Roles instead of names |
| Internal hostnames, table names, endpoints | Generic descriptions, or details fetched by a tool the model is authorized to use |
| Business rules you must enforce | Move the rule into code, keep a short mention at most |
| Unreviewed copied text | Retyped, reviewed text with a source note |
| Notes to self and debug lines | Nothing |
The deeper point: a prompt is not a vault
The model can be asked to repeat its instructions, and a determined user may succeed. Anything in the prompt should be something you could live with a user seeing. That rule also tells you what to move out: credentials and enforcement logic belong in code and configuration, where permissions are checked by software, not by the model's cooperation. See what never belongs in an LLM system prompt.
Before you commit
- Read the file top to bottom as if you were an outsider.
- Search it for anything that looks like a key, token, address or email.
- Look at the examples. Are any real?
- Check that every placeholder is a placeholder.
- Add the owner and origin header.
Automated checks on pull requests help, but they will not catch a customer's name in a sample ticket or a sentence describing an internal system. Human review of the text remains necessary, and your repository may already have a tool for detecting leaked credentials that you can point at the prompts folder.
If something sensitive was already committed
- Treat any credential as exposed. Revoke it and issue a new one first.
- Remove the text from the current version and record the incident.
- Decide with your security team whether history needs rewriting, knowing that clones and forks may already hold the old content.
- Check logs and other stores that may hold the rendered prompt.
For the credential case in detail, see a live secret appeared in your logs, what to do first.
Quick check
Is a private repository enough protection for secrets in a prompt?
No. Access still reaches many people and tools, and history persists. Keep credentials out of text files entirely.
Can I keep real examples if I remove names?
Often not safely, since details can still identify a person. Prefer invented examples.
Last reviewed: 19 October 2026.
