Plant the Canary Before You Spend a Free Model Call
If the prompt still holds a credential, do not call the model. Scan the fixture on your laptop, prove the scanner can fail, and only then spend a free model call or a free server run. I keep seeing the same shortcut in agent writeups. Someone wants a quick demo, so they paste a working tree. The tree still has a .env. Sometimes it has a cloud key. Sometimes it has a customer id that never belonged in a prompt. Why hand that to a model you are only trying? People are arguing, loudly, about what a
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.