Stage 1 · Lesson 4 of 7
Secrets: keys, tokens and where they live
A secret is anything that grants access: model , database passwords, , signing keys. AI projects leak secrets in familiar and new ways. Familiar: keys committed to Git, pasted into notebooks or printed in logs.
New: keys placed in a or a tool description, where the model can repeat them, and keys sitting in the environment of a machine where an agent runs generated code. Keep secrets in a secrets manager or environment variables on the server only, give each one the smallest scope and a spending limit where the provider allows, rotate them, and scan your repositories with a tool such as .
Common trapbelieving a secret is safe in a system prompt because users cannot see the prompt; this roadmap assumes every prompt can leak.
A question to check yourself, an AI practice session and 1 cheat sheet entry come with the full roadmap. Unlock
Resources for this stage
Start with· follow one of these
- RoadmapFreeSefism Cybersecurity Roadmap
Sefism · Beginner
Sefism's general security roadmap, for any foundation in this stage you want to study in more depth
- CourseFreeProfessor Messer's Security+ (SY0-701) Course
Professor Messer · Beginner
Free videos covering the core security concepts, from access control to cryptography
Practise
Keep handy
Also worth your time
The four questions, diagrams and STRIDE in one practical page
- roadmap.sh: Cyber SecurityGo deeper
A map of the wider security field, so you know where AI testing sits