no-sensitive-in-prompt

Prevents sensitive data (passwords, tokens, PII) from being sent to LLMs.

📊 Rule DetailsCopy Anchor Link

🔍 What This Rule DetectsCopy Anchor Link

This rule identifies code patterns where sensitive data like passwords, API keys, tokens, or personally identifiable information (PII) is passed to AI prompts. LLM providers may log, store, or use this data for training.

❌ Incorrect CodeCopy Anchor Link

// Password in prompt
await generateText({
  prompt: `Reset password for user. Current password: ${userPassword}`,
});

// API key in prompt
await generateText({
  prompt: `Configure service with key: ${apiKey}`,
});

// SSN in prompt
await streamText({
  prompt: `Process application for SSN: ${socialSecurityNumber}`,
});

// Credit card in prompt
await generateText({
  prompt: `Validate credit card: ${creditCardNumber}`,
});

✅ Correct CodeCopy Anchor Link

// Redacted data
await generateText({
  prompt: `Reset password for user. Current password: [REDACTED]`,
});

// No sensitive data
await generateText({
  prompt: `Configure service with the API key stored in environment variables.`,
});

// Use redaction helper
await streamText({
  prompt: `Process application for SSN: ${redact(socialSecurityNumber)}`,
});

// Reference instead of value
await generateText({
  prompt: `Validate the credit card on file for user ${userId}`,
});

⚙️ OptionsCopy Anchor Link

🛡️ Why This MattersCopy Anchor Link

Sending sensitive data to LLMs can result in:

• Data breach - LLM providers may store prompts
• Training data poisoning - Your data may be used to train models
• Compliance violations - GDPR, HIPAA, PCI-DSS violations
• Third-party exposure - Data shared with third-party AI providers

🔗 Related RulesCopy Anchor Link

• no-hardcoded-api-keys - Prevent hardcoded credentials
• require-output-filtering - Filter sensitive tool output

🔄 Changes in the 2026-10-10 FP/FN auditCopy Anchor Link

• Names are matched by whole word: businessName has no ssn word, and maxTokens / totalTokens are counts of tokens, not tokens.
• messages: [...] is searched: array elements, spread elements, and the values of message objects ({ role, content: `… ${user.password}` }).
• user['password'] is the same property as user.password.
• Options: the documented defaultOptions now apply. Earlier versions read context.options and silently ran a shorter hard-coded list instead.

🔄 Changes in the 2026-10-11 zero-deferral passCopy Anchor Link

• A whole record embedded in a prompt — JSON.stringify(x), String(x) or ${x} — is reported when its fields include a sensitive one:
  • with type information (parserOptions.projectService), the declared property names of x's type decide;
  • without it, x must resolve in the file to an object literal with a sensitive key, or to a full database row: a read from a Prisma, pg, postgres, mysql2, knex, kysely, drizzle, @vercel/postgres or better-sqlite3 client with no column projection (Prisma select/omit, select(cols), or SQL other than SELECT *).
• A field read (${user.name}) and chat history spread into messages are not records and are not reported.

Known False NegativesCopy Anchor Link

The following patterns are not detected due to static analysis limitations:

Variable Names Not Matching PatternsCopy Anchor Link

Why: Only configured sensitive patterns are checked.

// ❌ NOT DETECTED - Custom field name
await generateText({
  prompt: `Process data: ${mySecretField}`, // Not in sensitivePatterns
});

Mitigation: Configure sensitivePatterns with custom field names.

Dynamic Prompt ConstructionCopy Anchor Link

Why: Prompts built at runtime are not analyzed.

// ❌ NOT DETECTED - Dynamic prompt
const fields = [userPassword, apiKey];
const prompt = fields.join(', ');
await generateText({ prompt });

Mitigation: Never concatenate sensitive data into prompts.

Nested Object PropertiesCopy Anchor Link

Why: Deep property access may not be recognized.

// ❌ NOT DETECTED - Nested property
await generateText({
  prompt: `Reset with: ${user.credentials.password}`,
});

Mitigation: Configure patterns to match nested sensitive fields.

Encrypted/Transformed DataCopy Anchor Link

Why: Transformed data appears safe but may be sensitive.

// ❌ NOT DETECTED - Encrypted but still sensitive
await generateText({
  prompt: `Decrypt this: ${encryptedPassword}`,
});

Mitigation: Never send any form of credentials to LLMs.

📚 ReferencesCopy Anchor Link

• OWASP LLM02: Sensitive Information Disclosure
• CWE-200: Information Exposure

Use this rule

npm install -D oxlint-plugin-vercel-ai-security

{  "jsPlugins": ["oxlint-plugin-vercel-ai-security"],  "rules": {    "vercel-ai-security/no-sensitive-in-prompt": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-vercel-ai-security'],    rules: {      'vercel-ai-security/no-sensitive-in-prompt': 'error',    },  },});