26. Security Prompting

The lesson

Security prompts must avoid sharing passwords, API keys, private certificates, customer data, and undisclosed vulnerabilities with external tools.

Ask for threat models, attack surfaces, data-flow diagrams, input validation checks, dependency risks, and mitigation priorities.

AI security findings are suggestions. A human must verify exploitability and fixes.

A junior security analyst at a software company asks for a threat model of a login flow while leaving all live credentials out of the prompt.

A network team lead at a regional hospital requests a list of attack surfaces for a medical device network without naming any patient.

A security engineer at a payment provider asks for input validation checks on a form and removes customer identifiers before pasting the prompt.

An IT security officer at a municipal council requests a data-flow description of an internal service while excluding server addresses and keys.

A penetration tester at a consultancy writes a prompt about dependency risks and keeps undisclosed findings out of any external tool.

A junior support technician at a logistics firm drafts a prompt about suspicious email patterns and omits the sender addresses involved.

A security architect at a construction group asks for mitigation priorities for a document-sharing service without sharing the actual files.

A fraud analyst at an insurance company requests checks on claim submission patterns and strips all policyholder data from the text.

A junior developer at a game studio asks for a review of session handling and replaces real user tokens with placeholders.

A compliance engineer at an energy utility asks for a threat model of a control network while excluding network diagrams and device passwords.

Check yourself