[{"data":1,"prerenderedAt":749},["ShallowReactive",2],{"blog-detect-secrets-en":3},{"slug":4,"published":5,"minutes":6,"category":7,"tags":8,"keywords":13,"about":20,"sources":29,"cover":57,"og":58,"expertise":59,"locales":60,"lang":61,"title":64,"description":65,"coverAlt":66,"metaTitle":67,"takeaways":68,"faq":74,"toc":87,"blocks":112,"others":512},"detect-secrets","2026-08-03",10,"security",[9,10,11,12],"Secret scanning","Pre-commit","Git","DevSecOps",[4,14,15,16,17,18,19],"detect-secrets vs gitleaks","detect-secrets baseline","secret scanning tools comparison","gitleaks vs trufflehog","rotate leaked api keys","pre-commit secret hook",[21,24,26],{"name":22,"url":23},"Yelp","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FYelp",{"name":11,"url":25},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FGit",{"name":27,"url":28},"Apache License","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FApache_License",[30,33,36,39,42,45,48,51,54],{"title":31,"url":32},"Yelp\u002Fdetect-secrets: README and usage","https:\u002F\u002Fgithub.com\u002FYelp\u002Fdetect-secrets",{"title":34,"url":35},"Yelp\u002Fdetect-secrets: CHANGELOG (v1.5.0, 6 May 2024)","https:\u002F\u002Fgithub.com\u002FYelp\u002Fdetect-secrets\u002Fblob\u002Fmaster\u002FCHANGELOG.md",{"title":37,"url":38},"Yelp\u002Fdetect-secrets: plugin and verification documentation","https:\u002F\u002Fgithub.com\u002FYelp\u002Fdetect-secrets\u002Fblob\u002Fmaster\u002Fdocs\u002Fplugins.md",{"title":40,"url":41},"detect-secrets 1.5.0 on PyPI","https:\u002F\u002Fpypi.org\u002Fproject\u002Fdetect-secrets\u002F",{"title":43,"url":44},"Yelp\u002Fdetect-secrets: releases","https:\u002F\u002Fgithub.com\u002FYelp\u002Fdetect-secrets\u002Freleases",{"title":46,"url":47},"Gitleaks README (MIT, Go)","https:\u002F\u002Fgithub.com\u002Fgitleaks\u002Fgitleaks",{"title":49,"url":50},"TruffleHog README (AGPL-3.0, credential verification)","https:\u002F\u002Fgithub.com\u002Ftrufflesecurity\u002Ftrufflehog",{"title":52,"url":53},"GitHub Docs: About secret scanning","https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Fsecret-scanning\u002Fintroduction\u002Fabout-secret-scanning",{"title":55,"url":56},"betterleaks\u002Fbetterleaks","https:\u002F\u002Fgithub.com\u002Fbetterleaks\u002Fbetterleaks","\u002Fimages\u002Fblog\u002Fdetect-secrets\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fdetect-secrets\u002Fog.jpg","ai-engineer",[61,62,63],"en","de","hu","detect-secrets: secret scanning with a committed baseline","What detect-secrets does, how its committed baseline differs from gitleaks and TruffleHog, why verification calls matter in CI, and where the tool stops.","A wide sheet with five small squares, a magnifier above it and a line crossed below.","detect-secrets: scanning with a baseline · Balázs Csorba",[69,70,71,72,73],"detect-secrets accepts that a repository may already contain secrets. A committed .secrets.baseline records the findings and the hook blocks only new ones, so adoption needs no clean-up project first.","Precision comes from labels rather than better regexes: detect-secrets audit plus --stats is the measurement, and --exclude-files, --exclude-lines, --word-list and the two entropy thresholds are the tuning dials.","Verification is on by default and calls the issuing service over the network. That cuts false positives hard and needs a deliberate decision in an air-gapped CI runner.","Version 1.5.0 from 6 May 2024 is still the newest release, with Python 3.13 support sitting unreleased on master. Pin the version and do not plan new automation around new detectors.","gitleaks is the simpler pick for a new repository and TruffleHog is the one that confirms whether a key is still live. detect-secrets owns the audit and rotation workflow the other two do not have.",[75,78,81,84],{"q":76,"a":77},"What is a .secrets.baseline and why is it committed?","It is a JSON file listing every secret the tool currently finds, together with the plugin and filter configuration and a hash of each finding. Committing it gives the pre-commit hook a stable reference: findings already listed are ignored, anything new fails the commit. It doubles as the migration checklist, because detect-secrets audit labels which entries are real secrets.",{"q":79,"a":80},"Does detect-secrets find secrets in Git history?","No, and that is deliberate: it scans the Git-tracked files in the working tree, so a credential that was committed and removed years ago is invisible to it. The README frames this as avoiding the cost of walking history on every run. History needs a separate one-off scan with gitleaks or TruffleHog, plus a rewrite if the credential was ever valid.",{"q":82,"a":83},"What do --only-verified and --no-verify do?","By default the tool tries to verify every finding by calling the service that issued the credential, using the techniques from the keyhacks project. --only-verified reports just the credentials the service confirmed, which is precise but needs outbound network access; -n (--no-verify) turns verification off entirely, which is what an air-gapped CI runner needs.",{"q":85,"a":86},"Is detect-secrets still maintained?","Stable, but quiet: 1.5.0, published on 6 May 2024, is both the latest release on PyPI and the newest GitHub tag. Commits continue at a low rate, the last one on master is from April 2026, and Python 3.13 support was merged in January 2025 without a release. Treat it as maintained rather than developed, pin v1.5.0, and read master if you need the newer Python.",[88,91,94,97,100,103,106,109],{"id":89,"title":90},"what-it-is","What it is",{"id":92,"title":93},"how-it-works","How it works",{"id":95,"title":96},"getting-started","Getting started",{"id":98,"title":99},"signal-vs-noise","Signal and noise",{"id":101,"title":102},"rotation-workflow","The rotation workflow",{"id":104,"title":105},"where-it-shingles","Where it shingled badly",{"id":107,"title":108},"verdict","Verdict",{"id":110,"title":111},"sources","Sources",[113,117,126,129,145,223,224,227,233,236,247,248,259,261,264,266,281,296,297,300,348,361,362,373,385,388,389,392,456,459,460,463,475,481,482],{"type":114,"content":115},"paragraph",[116],"detect-secrets is Yelp's Apache-2.0 secret scanner for Git repositories, and the idea that sets it apart from every other one is the baseline. You accept that a repository may already contain secrets, you record what is in there, and from that point the tool blocks only new ones. It is a deliberately unglamorous design and it remains the right shape for a codebase nobody has time to clean. The catch is the maintenance state: 1.5.0 from 6 May 2024 is still the newest release, and the last commit on master landed in April 2026.",{"type":114,"content":118},[119,120,125],"It belongs in the same slot as gitleaks and TruffleHog, in front of the commit or the pipeline. It is not a secret manager: it finds, it blocks, and it hands you a list of what to rotate. GitHub's own secret scanning covers repositories hosted on GitHub and needs GitHub Secret Protection before it will scan private ones, and it does nothing for GitLab, Bitbucket or a self-hosted forge. For where a scanner belongs in an agent's sandboxing story, see ",{"tag":121,"to":122,"children":123},"link","\u002Fblog\u002Fsandboxing-coding-agents-ci-checklist",[124],"sandboxing coding agents in CI",".",{"type":127,"level":128,"id":89,"text":90},"heading",2,{"type":114,"content":130},[131,132,136,137,140,141,144],"The package ships three commands, and the README is unusually clear about which one to use when. ",{"tag":133,"children":134},"code",[135],"detect-secrets scan"," creates or updates the baseline, ",{"tag":133,"children":138},[139],"detect-secrets-hook"," checks a list of files against it and exits non-zero on anything new, and ",{"tag":133,"children":142},[143],"detect-secrets audit"," is an interactive session that labels findings as real secrets or false positives and writes those labels back into the baseline.",{"type":146,"ordered":147,"items":148},"list",false,[149,155,167,183,200,205,214],[150,154],{"tag":151,"children":152},"strong",[153],"Python, Apache-2.0, version 1.5.0",", published on 6 May 2024, with 4,649 stars and 573 forks. The PyPI classifier says production\u002Fstable, which describes the API more than the roadmap.",[156,159,160,163,164,125],{"tag":151,"children":157},[158],"27 detectors"," listed by ",{"tag":133,"children":161},[162],"--list-all-plugins",", in three families: regex rules for AWS, GitHub, GitLab, Slack, Stripe, OpenAI, npm, PyPI, Telegram, Twilio and private keys; entropy detectors for Base64 and hex strings; and a keyword detector that ignores the value and flags assignments to names such as ",{"tag":133,"children":165},[166],"password",[168,171,172,175,176,175,179,182],{"tag":151,"children":169},[170],"Filters run after the plugins"," and decide what survives: ",{"tag":133,"children":173},[174],"--exclude-files",", ",{"tag":133,"children":177},[178],"--exclude-lines",{"tag":133,"children":180},[181],"--exclude-secrets",", a word list of your own identifiers, and inline pragmas.",[184,187,188,191,192,195,196,199],{"tag":151,"children":185},[186],"Verification is on by default",". For patterns it recognises, the tool calls the issuing service to ask whether the credential is real. ",{"tag":133,"children":189},[190],"-n"," (",{"tag":133,"children":193},[194],"--no-verify",") turns that off, ",{"tag":133,"children":197},[198],"--only-verified"," keeps only the confirmed ones.",[201,204],{"tag":151,"children":202},[203],"The baseline is the entire state",". It is a JSON file committed to the repository that stores the plugin and filter configuration plus a hashed fingerprint for every finding.",[206,209,210,213],{"tag":151,"children":207},[208],"Audit is the measurement",". Labels make ",{"tag":133,"children":211},[212],"detect-secrets audit --stats"," report how well each detector performed on your code, which is the only way to tune it honestly.",[215,218,219,222],{"tag":151,"children":216},[217],"Three deployment shapes",": a pre-commit hook, a CI job over staged or tracked files, or a library through ",{"tag":133,"children":220},[221],"SecretsCollection"," when you need it inside your own tooling.",{"type":127,"level":128,"id":92,"text":93},{"type":114,"content":225},[226],"The engine has two stages. Plugins produce potential secrets, then filters and the verification policy decide which of them are reported. Transformers normalise the input first, which is why INI, YAML, XML and Markdown files can be scanned line by line without special cases per format. A serialisable settings object ties the two halves together and travels inside the baseline, so a scan on a CI runner uses exactly the configuration that produced the file on a laptop.",{"type":228,"src":229,"alt":230,"wide":231,"caption":232},"image","\u002Fimages\u002Fblog\u002Fdetect-secrets\u002Fdiagram-7.webp","detect-secrets: scan once, gate every commit Git-tracked files pass through transformers, plugins and filters, verification makes a network call where a plugin supports it, and the result is written to a committed JSON baseline. The pre-commit hook and the audit session both read that baseline.",true,"One scan produces the baseline; the hook and the audit session only read it.",{"type":114,"content":234},[235],"Verification is the mechanism that decides whether the tool is usable in practice. Since 0.12.4 a plugin can implement a verify function that asks the issuing service whether the credential is live, using the techniques catalogued by the keyhacks project. Verification is also handed five lines of context on either side of the match, because the research behind that choice found an 80 per cent chance of finding the second half of a multi-factor secret nearby. The gain in precision is large; the cost is an outbound network request on every commit that touches a matching line.",{"type":114,"content":237},[238,239,242,243,246],"The baseline then does the separating of concerns. ",{"tag":133,"children":240},[241],"detect-secrets scan --baseline .secrets.baseline"," rescans the tree, migrates the file to the current format, adds new findings, drops the ones that disappeared and preserves the audit labels, so its diff stays small enough to review. The ",{"tag":133,"children":244},[245],"--slim"," flag pushes that further and minimises the diff between commits, at the cost of the audit feature: slim baselines cannot be audited later, so they have to be remade.",{"type":127,"level":128,"id":95,"text":96},{"type":114,"content":249},[250,251,254,255,258],"Installation is ",{"tag":133,"children":252},[253],"pip install detect-secrets"," or ",{"tag":133,"children":256},[257],"brew install detect-secrets",". Version 1.5.0 supports Python 3.8 to 3.12 and dropped 3.6 and 3.7; master already carries Python 3.13 support, but that change has not shipped in a release, so a 3.13 environment has to install from git. The documented setup is a pre-commit hook with the baseline as an argument.",{"type":133,"code":260},"# .pre-commit-config.yaml\nrepos:\n  - repo: https:\u002F\u002Fgithub.com\u002FYelp\u002Fdetect-secrets\n    rev: v1.5.0\n    hooks:\n      - id: detect-secrets\n        args: ['--baseline', '.secrets.baseline']\n        exclude: package.lock.json",{"type":114,"content":262},[263],"Then create the baseline once, from the repository root, and commit it. From that moment the hook runs on every commit and fails only on lines that are not in the file. The first scan of an old repository can return thousands of findings, which is precisely the situation the baseline exists for.",{"type":133,"code":265},"pip install detect-secrets\n\n# once, from the repository root: record what is already there\ndetect-secrets scan > .secrets.baseline\n\n# after real leaks are rotated, or the repo legitimately grew\ndetect-secrets scan --baseline .secrets.baseline\n\n# label findings once, then keep the labels\ndetect-secrets audit .secrets.baseline\n\n# CI: fail the build on anything the baseline does not list\ngit diff --staged --name-only -z | xargs -0 \\\n  detect-secrets-hook --baseline .secrets.baseline",{"type":114,"content":267},[268,269,272,273,276,277,280],"Inline allowlisting is the other half of the workflow. A line ending in ",{"tag":133,"children":270},[271],"# pragma: allowlist secret",", or a line carrying ",{"tag":133,"children":274},[275],"\u002F\u002F pragma: allowlist nextline secret"," above it, is skipped without touching the baseline, which is the right tool for a test fixture or a documentation example. ",{"tag":133,"children":278},[279],"detect-secrets scan --only-allowlisted"," inverts the check and reports exactly those lines, so the pragma cannot quietly become the place where real credentials hide.",{"type":282,"variant":283,"title":284,"body":285},"callout","warn","Two things to settle before this goes into a build",[286,291],[287,288,290],"Verification makes outbound requests to third-party APIs on every machine that runs the hook. In a locked-down CI network that either slows the scan down or fails it, so decide deliberately between ",{"tag":133,"children":289},[190]," in CI and a proxy allowlist for the services you verify against.",[292,295],{"tag":133,"children":293},[294],"detect-secrets audit --report"," can print the secret values themselves. Run the audit on a laptop, and never paste its output into a ticket, a chat or a CI log. The baseline only ever stores hashes.",{"type":127,"level":128,"id":98,"text":99},{"type":114,"content":298},[299],"Out of the box the detectors are tuned for a generic repository, and the work that follows is tuning them for yours. The audit step is not a formality: it is the only measurement available, and it is manual.",{"type":146,"ordered":231,"items":301},[302,307,318,328,338,342],[303,304,306],"Generate the baseline, then label a representative sample with ",{"tag":133,"children":305},[143],". Nothing else in this list works without it.",[308,309,312,313,315,316,125],"Read the statistics. Detectors that produce mostly false positives get disabled with ",{"tag":133,"children":310},[311],"--disable-plugin",", or narrowed with ",{"tag":133,"children":314},[174]," and ",{"tag":133,"children":317},[178],[319,320,323,324,327],"Move the entropy thresholds instead of deleting detectors: ",{"tag":133,"children":321},[322],"--base64-limit"," defaults to 4.5 and ",{"tag":133,"children":325},[326],"--hex-limit"," to 3.0, and those are the two dials the tool exposes.",[329,330,333,334,337],"Add a word list of your own identifiers with ",{"tag":133,"children":331},[332],"--word-list",", which needs the ",{"tag":133,"children":335},[336],"detect-secrets[word_list]"," extra.",[339,340,125],"Consider the optional gibberish model for secrets that look like words. It is not on by default because it also ignores values such as ",{"tag":133,"children":341},[166],[343,344,347],"Re-scan with ",{"tag":133,"children":345},[346],"--baseline"," after every change and read the diff of the baseline file. A shrinking diff means less noise, not fewer secrets.",{"type":282,"variant":349,"title":350,"body":351},"tip","Ship the gate in two steps",[352],[353,354,356,357,360],"Run the hook in report-only mode for a sprint and count findings per thousand lines of changed code. Only then make it blocking. A gate that cries wolf gets bypassed with ",{"tag":133,"children":355},[190],", a ",{"tag":133,"children":358},[359],"SKIP"," prefix or a force-push, and a bypassed gate is worse than no gate because the team believes it is covered.",{"type":127,"level":128,"id":101,"text":102},{"type":114,"content":363},[364,365,368,369,372],"The third command is what pays for the tuning, and it is not about finding anything new. Audit labels write ",{"tag":133,"children":366},[367],"is_secret"," into the baseline; combined with ",{"tag":133,"children":370},[371],"--report"," they produce the list of credentials still sitting in the repository that need replacing. That list is what turns a scan into a security task with an owner and a deadline.",{"type":146,"ordered":147,"items":374},[375,377,379,383],[376],"Label first, report second. A finding marked as a real secret in the baseline is an entry in the migration list.",[378],"Rotate at the provider, not in the repository. Deleting the file changes nothing about whether the key works.",[343,380,382],{"tag":133,"children":381},[346]," afterwards. The finding disappears from the file, and that diff is the evidence the migration finished.",[384],"Keep history scanning separate. The tool never looks at old commits, so a rewrite or a one-off history scan is a different job.",{"type":114,"content":386},[387],"This is the separation of concerns the README describes, and it is still the best argument for the tool. It does not demand that you clean the repository before it becomes useful, which is exactly what a scanner bolted onto a mature codebase usually demands.",{"type":127,"level":128,"id":104,"text":105},{"type":114,"content":390},[391],"The weaknesses are structural rather than cosmetic. It will not catch a multi-line secret or a default password the keyword detector does not recognise, and the README says so in a section titled Caveats. It does not scan Git history by design, so a credential that was committed and deleted years ago is invisible to it. Custom plugins are loaded by importing an arbitrary file, which the plugin documentation flags as a security assumption of its own. And the project is in maintenance mode: 1.5.0 from May 2024 is still the newest tag, Python 3.13 support has been sitting on master since January 2025, and the issue tracker holds 184 open issues.",{"type":393,"head":394,"rows":402},"table",[395,397,398,400],[396],"Attribute",[4],[399],"gitleaks",[401],"TruffleHog",[403,412,420,429,438,447],[404,406,408,410],[405],"Licence",[407],"Apache-2.0",[409],"MIT",[411],"AGPL-3.0",[413,415,417,419],[414],"Language",[416],"Python",[418],"Go",[418],[421,423,425,427],[422],"Detection model",[424],"27 detectors: regex rules, entropy strings, keyword names",[426],"TOML rule set, regex plus entropy, extended rule by rule",[428],"Over 800 classified credential types",[430,432,434,436],[431],"Verification",[433],"Yes, a network call per recognised pattern",[435],"No",[437],"Yes, it logs in to check whether the credential is live",[439,441,443,445],[440],"What it reads",[442],"Git-tracked files in the worktree, plus the library API",[444],"Git patches through git log -p, directories, stdin",[446],"Git, GitHub, GitLab, S3, GCS, Docker, Jenkins, Elasticsearch and more",[448,450,452,454],[449],"Known state",[451],"Accepted findings: a committed, audited baseline",[453],"Findings from a report file used as a baseline path",[455],"Result filtering, no baseline concept",{"type":114,"content":457},[458],"The comparison that matters is where the effort goes. gitleaks is one Go binary with an excellent TOML rule format, faster to adopt, and its author now states plainly that the project is feature complete with security patches only and that new work has moved to a different project. TruffleHog goes the other way: it verifies credentials against live APIs, which is the only way to be sure a finding is urgent, and it pays for that with 800-odd credential types and an AGPL-3.0 licence that some legal departments will not sign. detect-secrets trades breadth for the one workflow the others lack: an audited, committed list of what is already known, and a migration off it.",{"type":127,"level":128,"id":107,"text":108},{"type":114,"content":461},[462],"Adopt it, but as infrastructure rather than as a project. The baseline model is the correct answer for a repository with years of history and no budget for a clean-up sprint, and it produces the artefact a security review actually asks for: a list of credentials to rotate. It is not the tool to reach for in a greenfield repository, where gitleaks is simpler, or for a team that needs to know whether a leaked key still works, which is TruffleHog's job.",{"type":146,"ordered":231,"items":464},[465,467,469,471,473],[466],"Choose it when the repository already holds secrets, the history cannot be rewritten, and the goal is to stop the bleeding without a migration project.",[468],"Keep the baseline in the repository and make its diff part of the review. A baseline that changes in an unexplained commit is the failure mode to watch for.",[470],"Budget a day for tuning. The tool is exactly as good as its labelled baseline, and the labelling is manual.",[472],"Pair it with server-side scanning rather than replacing it. detect-secrets blocks on a developer's machine; something still has to scan what already landed.",[474],"Do not build new automation on the assumption that the detector set will grow. Pin 1.5.0, read master if you need Python 3.13, and budget for a successor if the project stays quiet.",{"type":282,"variant":476,"title":477,"body":478},"note","One rule of thumb",[479],[480],"If nobody on the team is willing to rotate the keys the baseline lists, running detect-secrets buys nothing. It reduces the number of future incidents; it does not reduce the ones already in the repository.",{"type":127,"level":128,"id":110,"text":111},{"type":146,"ordered":231,"items":483},[484,488,491,494,497,500,503,506,509],[485],{"tag":486,"href":32,"children":487},"a",[31],[489],{"tag":486,"href":35,"children":490},[34],[492],{"tag":486,"href":38,"children":493},[37],[495],{"tag":486,"href":41,"children":496},[40],[498],{"tag":486,"href":44,"children":499},[43],[501],{"tag":486,"href":47,"children":502},[46],[504],{"tag":486,"href":50,"children":505},[49],[507],{"tag":486,"href":53,"children":508},[52],[510],{"tag":486,"href":56,"children":511},[55],[513,581,651,707],{"slug":514,"published":515,"minutes":516,"category":7,"tags":517,"keywords":523,"about":536,"sources":544,"cover":575,"og":576,"expertise":59,"locales":577,"lang":61,"title":578,"description":579,"coverAlt":580},"llm-output-guardrails-moderation","2026-10-17",13,[518,519,520,521,522],"LLM security","Guardrails","Content moderation","OWASP","Output validation",[524,525,526,527,528,529,530,531,532,533,534,535],"llm output guardrails","improper output handling llm","owasp llm05","openai moderation api","omni-moderation-latest","llama guard 4","nemo guardrails streaming","markdown image exfiltration","sanitize llm output html","groundedness detection","llm content moderation production","output rails",[537,539,542],{"name":520,"url":538},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FContent_moderation",{"name":540,"url":541},"Cross-site scripting","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FCross-site_scripting",{"name":521,"url":543},"https:\u002F\u002Fowasp.org\u002F",[545,548,551,554,557,560,563,566,569,572],{"title":546,"url":547},"OWASP GenAI Security Project: LLM05:2025 Improper Output Handling","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm052025-improper-output-handling\u002F",{"title":549,"url":550},"OpenAI API Docs: Moderation","https:\u002F\u002Fplatform.openai.com\u002Fdocs\u002Fguides\u002Fmoderation",{"title":552,"url":553},"Meta: Llama Guard 4 model card and prompt formats","https:\u002F\u002Fwww.llama.com\u002Fdocs\u002Fmodel-cards-and-prompt-formats\u002Fllama-guard-4\u002F",{"title":555,"url":556},"NVIDIA NeMo Guardrails: Output rail streaming configuration","https:\u002F\u002Fdocs.nvidia.com\u002Fnemo\u002Fguardrails\u002Fconfigure-guardrails\u002Fyaml-schema\u002Fstreaming\u002Foutput-rail-streaming.md",{"title":558,"url":559},"Microsoft Learn: Prompt Shields in Azure AI Content Safety","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fai-services\u002Fcontent-safety\u002Fconcepts\u002Fjailbreak-detection",{"title":561,"url":562},"Microsoft Learn: Groundedness detection in Azure AI Content Safety","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fai-services\u002Fcontent-safety\u002Fconcepts\u002Fgroundedness",{"title":564,"url":565},"Microsoft Learn: Protected material detection in Azure AI Content Safety","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fai-services\u002Fcontent-safety\u002Fconcepts\u002Fprotected-material",{"title":567,"url":568},"Guardrails AI documentation","https:\u002F\u002Fwww.guardrailsai.com\u002Fdocs",{"title":570,"url":571},"Vue.js docs: Security best practices","https:\u002F\u002Fvuejs.org\u002Fguide\u002Fbest-practices\u002Fsecurity.html",{"title":573,"url":574},"Simon Willison: Remote prompt injection in GitLab Duo leads to source code theft","https:\u002F\u002Fsimonwillison.net\u002F2025\u002FMay\u002F23\u002Fremote-prompt-injection-in-gitlab-duo\u002F","\u002Fimages\u002Fblog\u002Fllm-output-guardrails-moderation\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fllm-output-guardrails-moderation\u002Fog.jpg",[61,62,63],"LLM output guardrails: moderation, safe rendering and validation before anything acts","What to check after the model answers: safe Markdown rendering, schema checks before actions, moderation classifiers, streaming rails and groundedness.","Three narrowing rectangular frames stacked as a funnel, dots falling through to a tray beside a lock.",{"slug":582,"published":515,"minutes":583,"category":7,"tags":584,"keywords":588,"about":600,"sources":608,"cover":645,"og":646,"expertise":59,"locales":647,"lang":61,"title":648,"description":649,"coverAlt":650},"ai-red-teaming-checklist-llm-apps",12,[585,518,521,586,587],"AI red teaming","promptfoo","Penetration testing",[589,590,591,592,593,594,595,596,597,598,599],"ai red teaming checklist","llm red teaming","red teaming llm applications","owasp genai red teaming guide","promptfoo red team","garak llm scanner","pyrit red teaming","llm penetration testing","owasp top 10 llm 2025 testing","jailbreak testing llm app","red team rag chatbot",[601,604,607],{"name":602,"url":603},"Red team","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FRed_team",{"name":605,"url":606},"Prompt injection","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FPrompt_injection",{"name":521,"url":543},[609,612,615,618,621,624,627,630,633,636,639,642],{"title":610,"url":611},"OWASP GenAI Security Project: GenAI Red Teaming Guide (January 2025)","https:\u002F\u002Fgenai.owasp.org\u002Fresource\u002Fgenai-red-teaming-guide\u002F",{"title":613,"url":614},"OWASP GenAI Security Project: Top 10 for LLM Applications 2025","https:\u002F\u002Fgenai.owasp.org\u002Fllm-top-10\u002F",{"title":616,"url":617},"Bullwinkel et al. (Microsoft): Lessons From Red Teaming 100 Generative AI Products (2025)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2501.07238",{"title":619,"url":620},"NIST AI 600-1: Generative Artificial Intelligence Profile (July 2024)","https:\u002F\u002Fnvlpubs.nist.gov\u002Fnistpubs\u002Fai\u002FNIST.AI.600-1.pdf",{"title":622,"url":623},"Promptfoo Docs: Red team quickstart","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fquickstart\u002F",{"title":625,"url":626},"Promptfoo Docs: Red team configuration","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fconfiguration\u002F",{"title":628,"url":629},"Promptfoo Docs: Red team plugins","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fplugins\u002F",{"title":631,"url":632},"Promptfoo Docs: Red team strategies","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fstrategies\u002F",{"title":634,"url":635},"NVIDIA garak: LLM vulnerability scanner (GitHub)","https:\u002F\u002Fgithub.com\u002FNVIDIA\u002Fgarak",{"title":637,"url":638},"Microsoft PyRIT documentation","https:\u002F\u002Fmicrosoft.github.io\u002FPyRIT\u002F",{"title":640,"url":641},"EU AI Act, Article 55: Obligations for providers of GPAI models with systemic risk","https:\u002F\u002Fartificialintelligenceact.eu\u002Farticle\u002F55\u002F",{"title":643,"url":644},"OWASP GenAI LLM Top 10 2026: final entries (GitHub)","https:\u002F\u002Fgithub.com\u002FGenAI-Security-Project\u002FGenAI-LLM-Top10\u002Ftree\u002Fmain\u002F2026\u002Ffinal","\u002Fimages\u002Fblog\u002Fai-red-teaming-checklist-llm-apps\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fai-red-teaming-checklist-llm-apps\u002Fog.jpg",[61,62,63],"AI red teaming checklist for LLM apps: what to attack before your users do","A practical red teaming checklist for LLM features: scope, OWASP 2025 test cases, promptfoo, garak and PyRIT, human testers and regression tests.","A clipboard list, then a crossed shield and a check at the end of a curved line.",{"slug":652,"published":653,"minutes":654,"category":7,"tags":655,"keywords":661,"about":672,"sources":682,"cover":701,"og":702,"expertise":59,"locales":703,"lang":61,"title":704,"description":705,"coverAlt":706},"slopsquatting-ai-package-hallucinations","2026-10-16",6,[656,657,658,659,660],"Supply chain security","Coding agents","npm","PyPI","Package hallucination",[662,663,664,665,666,667,668,669,670,671],"slopsquatting","package hallucination","ai hallucinated packages","llm package confusion attack","coding agent supply chain security","npm min-release-age","pnpm minimumReleaseAge","uv exclude-newer","npm ignore-scripts","huggingface-cli hallucinated package",[673,676,679],{"name":674,"url":675},"Typosquatting","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FTyposquatting",{"name":677,"url":678},"Supply chain attack","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSupply_chain_attack",{"name":680,"url":681},"Hallucination (artificial intelligence)","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FHallucination_(artificial_intelligence)",[683,686,689,692,695,698],{"title":684,"url":685},"Spracklen et al.: We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs (2024)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2406.10279",{"title":687,"url":688},"Lasso Security, Bar Lanyado: Diving Deeper into AI Package Hallucinations (Mar 2024)","https:\u002F\u002Fwww.lasso.security\u002Fblog\u002Fai-package-hallucinations",{"title":690,"url":691},"npm Docs: config (min-release-age, before, ignore-scripts, allow-scripts)","https:\u002F\u002Fdocs.npmjs.com\u002Fcli\u002Fv11\u002Fusing-npm\u002Fconfig",{"title":693,"url":694},"pnpm: Dependency resolution settings (minimumReleaseAge)","https:\u002F\u002Fpnpm.io\u002Fsettings\u002Fdependency-resolution",{"title":696,"url":697},"uv: Settings reference (exclude-newer, require-hashes)","https:\u002F\u002Fdocs.astral.sh\u002Fuv\u002Freference\u002Fsettings\u002F",{"title":699,"url":700},"pip documentation: Secure installs and hash-checking mode","https:\u002F\u002Fpip.pypa.io\u002Fen\u002Fstable\u002Ftopics\u002Fsecure-installs\u002F","\u002Fimages\u002Fblog\u002Fslopsquatting-ai-package-hallucinations\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fslopsquatting-ai-package-hallucinations\u002Fog.jpg",[61,62,63],"Slopsquatting: when coding agents install packages that do not exist","How LLMs hallucinate package names, how attackers register them, and the registry, lockfile and agent-harness controls that stop the install.","Three boxes on a rail, the middle one hollow and offset, aligned squares on a tray below.",{"slug":708,"published":653,"minutes":654,"category":7,"tags":709,"keywords":713,"about":724,"sources":730,"cover":743,"og":744,"expertise":59,"locales":745,"lang":61,"title":746,"description":747,"coverAlt":748},"rag-poisoning-knowledge-base-attacks",[710,711,605,521,712],"RAG security","Data poisoning","Vector database",[714,715,716,717,718,719,720,721,722,723],"rag poisoning","knowledge base poisoning","poisonedrag","rag security","indirect prompt injection rag","owasp llm08 vector and embedding weaknesses","vector database security","rag data poisoning defense","hidden text prompt injection","secure rag ingestion",[725,728,729],{"name":726,"url":727},"Retrieval-augmented generation","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FRetrieval-augmented_generation",{"name":605,"url":606},{"name":521,"url":543},[731,734,737,740],{"title":732,"url":733},"Zou et al.: PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models (2024)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2402.07867",{"title":735,"url":736},"Greshake et al.: Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2302.12173",{"title":738,"url":739},"OWASP Gen AI Security Project: LLM08:2025 Vector and Embedding Weaknesses","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm082025-vector-and-embedding-weaknesses\u002F",{"title":741,"url":742},"OWASP Gen AI Security Project: LLM04:2025 Data and Model Poisoning","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm042025-data-and-model-poisoning\u002F","\u002Fimages\u002Fblog\u002Frag-poisoning-knowledge-base-attacks\u002Fcover.webp","\u002Fimages\u002Fblog\u002Frag-poisoning-knowledge-base-attacks\u002Fog.jpg",[61,62,63],"RAG poisoning: how a few documents can steer your assistant, and how to defend the knowledge base","How attackers plant documents that RAG systems retrieve, what PoisonedRAG and OWASP show, and the ingestion, retrieval and answer controls that limit it.","Sheets feeding a container on a belt, one carrying a small block, a gate before the exit.",1792261156164]