Security Test: LLM Sensitive Information Disclosure¶

Scanner(s) Support¶

Description¶

Default Severity: high

LLMs can accidentally share sensitive data if they're not used carefully, meaning private or confidential information might get exposed through their responses. This happens when input data isn't properly checked or when the models unintentionally recall details from their training, which could include proprietary or confidential material. The danger is that attackers or careless handling might lead to leaks, harming privacy or giving away secrets. Developers often overlook the importance of sanitizing inputs and monitoring outputs, with the risk compounding if the models are fed sensitive data without proper precautions.

Reference:

• https://genai.owasp.org/llmrisk/llm06-sensitive-information-disclosure/
  • https://owasp.org/www-project-top-10-for-large-language-model-applications/

Configuration¶

Identifier: injection/llm_sensitive_information_disclosure

Examples¶

All configuration available:

checks:
  injection/llm_sensitive_information_disclosure:
    skip: false # default

Compliance and Standards¶