Appsec reviews prompt-template repositories across municipal repos and finds hard-coded secrets. What hygiene practice should GenAI architecture enforce?
Select an answer to reveal the explanation.
Short Explanation
Prompt templates are source code’s chatty cousins — they get copied, forked, and pasted into tickets. Keep keys in a secrets manager and out of those files. Renaming .env to .bak is a costume, not hygiene.
Full Explanation
Prompt templates and GenAI configuration files are frequently versioned across municipal repositories, making hard-coded API keys and tokens a durable leak path through git history, forks, and CI logs. GenAI architecture and repository standards should store credentials in a secrets manager and keep prompt/config artifacts free of embedded secrets, injecting keys at runtime into server-side components only. Secret scanning and pre-commit hooks reinforce that hygiene.
Committing production keys into prompt templates so environments stay in sync weaponizes "sync" as a leak mechanism and freezes secrets into durable history. Emailing secrets to the whole GenAI working group after each sprint expands the audience and creates unmanaged copies in mailboxes. Hiding secrets only by renaming files from .env to .bak is obscurity without access control and often still ends up in backups or tickets.
Exam caveat: prompt repos are code—treat them with the same secret-hygiene bar as application source, including history scrubbing when leaks occur. Operational check: run secret scanners across municipal GenAI prompt repos, migrate keys to a secrets manager, rotate any exposed credentials, and add CI checks that fail builds when high-entropy secrets appear in templates.