Secret-risk pattern

Exposed Secret Context

AI tools do not need to print raw keys to create risk; file paths, variable names, logs, and configuration context can reveal how systems are wired.

Severity: CriticalDetected by: Starter, Growth, and Pro

Signals CapitalGuard looks for

Environment files inside default workspaces

Deployment logs with credential-shaped values

Service-account, token, or webhook references in code

Secret context can help attackers map production systems even when raw values are redacted.

Agents may summarize sensitive paths while debugging or preparing status reports.

Screenshots, demos, and copied findings can accidentally spread sensitive context.

Block sensitive paths from agent reads and summaries.

Redact values in reports, dashboards, and partner demos.

Move operational credentials to provider vaults and rotate exposed material.

Next step

Related threats

Agent instruction risk

Hidden instructions in docs, issues, prompts, logs, and internal notes can influence coding agents when those files become task context.

Some files should not be read, edited, summarized, or sent to external tools by autonomous coding agents.

Agents that can edit workflows, package scripts, deploy files, or release automation can turn small mistakes into production risk.