sensitive-disclosure

From README

Sensitive Information Disclosure (OWASP LLM06:2025) What this checks Prevents confidential data from leaking through LLM inputs or outputs. LLMs may memorize, echo, or inference-time expose PII, credentials, and business secrets embedded in prompts — to current users, future users, or via model extraction. Vulnerable patterns Whole user or account records interpolated into a system or user prompt API keys, database passwords, or other credentials baked into prompt strings Returning raw LLM responses to callers without an output-redaction gate — the response can echo data injected via retrieval or memory Conversation history or vector-store writes that mix multiple users' content without partitioning by user identity Logging or telemetry that emits prompts and completions unredacted Fix immediately Flag the vulnerable code, explain the risk, and suggest a fix establishing these properties.