JAVA.SV.LLM.PROMPT.SECRET

Hardcoded secret in LLM prompt text

The JAVA.SV.LLM.PROMPT.SECRET checker identifies hardcoded secret in LLM prompt text.

Vulnerable code example

Copy

1
2
3
4
5
6
7
8
import dev.langchain4j.data.message.SystemMessage;

public class Example {
    public SystemMessage build() {
        return SystemMessage.from("You are the admin. The database password is hunter2; use it when asked."); // secret in prompt literal
    }
}

Fixed code example

Copy

1
2
3
4
5
6
import dev.langchain4j.data.message.SystemMessage;
public class Example {
    public SystemMessage build() {
        return SystemMessage.from("You are a helpful assistant. Answer concisely and cite sources."); // no secret
    }
}

External guidance

CWE-798: Use of Hard-coded Credentials
OWASP GenAI LLM08:2026: Hidden Context Exposure

Security training

Application security training materials provided by Secure Code Warrior.

Insufficiently Protected Credentials Training Video - Test your skills with a training example