Cheat sheet · 5 min read

Your AI's system prompt isn't private

If you've built a custom GPT or chatbot, assume a determined user can read its instructions. Build accordingly.

By Abi Odedeyi · CodeFreeIQ

A lot of people paste their secret sauce, pricing logic, internal rules, even API keys, straight into a custom AI's instructions and assume it's hidden. It often isn't. With the right nudging, chatbots can be coaxed into revealing their own setup. Here's what leaks, and how to build so it doesn't matter.

What's inside

1What a chatbot can reveal about itself 2Keep keys out of the prompt 3Guardrails for a public bot

What actually leaks

Two things you should never treat as private inside an AI's instructions: the instructions themselves (users can often extract them), and any secret embedded in them, keys, passwords, internal-only pricing. If losing it would hurt, it does not belong in the prompt.

Safe to include

Tone, role, what topics to help with, how to escalate, public-facing info.

Never include

API keys, passwords, internal margins, anything you'd be upset to see screenshotted.

What this means for you: treat the system prompt like a label on the outside of the box, not a safe inside it.

Keep secrets in the plumbing, not the prompt

Real secrets belong in the layer users can't see: environment variables, a backend, a proper connector, not the text you typed into the AI. If your tool needs a key to work, it should read it from a secure place at run time, never carry it in its own instructions.

What this means for you: the rule is simple: the AI can use a secret without being told the secret in plain text. That's a build decision, and it's the one that matters most.

Guardrails for anything customers can talk to

If the public can chat with your AI, add a layer that refuses off-topic, sensitive or manipulative requests before they reach the model, and always hands medical, legal, financial or order-specific questions to a human. Design for the user who's trying to break it, not just the one behaving.

What this means for you: a customer-facing bot without guardrails isn't a feature, it's a risk. Build the fence before you open the gate.