Secrets

Exposed API key in environment config

An attacker could use the key to access third-party services, customer data, or generate unexpected usage costs.

Revoke and rotate the key, move secrets into a managed secret store, and add secret scanning to CI.

Prompt security

User input passed directly into LLM system prompt

A malicious user can override privileged instructions or influence downstream tool calls.

Separate system and user messages, add prompt boundaries, and validate model output before taking action.

AI agents

Agent has unrestricted filesystem access

Prompt injection or tool-output manipulation could cause the agent to read or modify sensitive files.

Sandbox the agent, allowlist paths and operations, require approval for sensitive actions, and log all tool calls.

LLM output validation

Missing output validation before tool call

Untrusted model output can trigger unintended API requests, data writes, or workflow actions.

Validate output against a strict schema, enforce allowlists, and run authorization checks before execution.

RAG security

Public vector database endpoint

Embeddings and retrieved documents may expose sensitive business or customer information.

Require authentication, restrict network access, encrypt data, and scope indexes by tenant or environment.

Abuse controls

Missing rate limit on AI endpoint

Public users can drive model costs, degrade service reliability, or attempt automated prompt abuse.

Add authentication, request throttling, per-user quotas, and model usage caps.