LLM06:2025 Sensitive Information Disclosure

Secrets, PII or PHI flow into an LLM prompt or context window. The provider logs the prompt, the model echoes it to another caller, or a training pipeline ingests it: either way the data has left your trust boundary.

What Vulkro detects

LLM SDK calls whose prompt argument is taint-reachable from a secret literal, an environment variable known to hold credentials, or a database column marked PII / PHI by the data-flow pass.

Non-compliant code

# A payment key flows into the prompt body
resp = client.chat.completions.create(
    model='gpt-4o',
    messages=[
        {'role': 'system', 'content': f'Process payments via key {os.environ["STRIPE_SK"]}'},
        {'role': 'user', 'content': user_question},
    ],
)

Compliant code

# The key stays server-side; the model only calls a tool
TOOLS = [{'type': 'function', 'function': {'name': 'charge_card', 'parameters': {...}}}]
resp = client.chat.completions.create(
    model='gpt-4o',
    messages=[
        {'role': 'system', 'content': 'You are a billing assistant. Call charge_card to process payments.'},
        {'role': 'user', 'content': user_question},
    ],
    tools=TOOLS,
)

References

• CWE-200
• CWE-359
• OWASP LLM02:2025 Sensitive Information Disclosure

See also: Confidence model.

---

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.