TryBench
Shadow-AI Governance & Secret Leaks
Enforce approved workplace AI tools, classify data, sanitize configs, and rotate credentials if leaked.
Why this matters
Staff paste company secrets into free AI tools to save time. That can expose passwords and keys. Safe habits protect the whole company.
Unapproved AI Tools Leak Secrets
"Shadow AI" means using AI tools your company has not approved. What you paste there may be stored or used for training. Use approved tools.
In real life: A worker pastes the company's database password into a free chatbot "just to get help". The password is now outside the company. That is why approved tools exist.
Replace Secrets With Labels
When you share a sample config, replace tokens with [REDACTED_API_KEY] and passwords with [REDACTED_DB_PASS]. Keep variable names and hostnames.
In real life: When you share a config as an example, swap each secret for a clear label. Keep the variable names so the example still makes sense.
Always Replace a Leaked Secret
Hiding a secret afterward does not undo a leak. 1. Replace the live secret with a new one. 2. Check the access logs. 3. Store secrets in a secret manager.
In real life: If you shout your PIN in a crowd, putting a hand over your mouth afterward does not help. You change the PIN. A leaked secret must be replaced with a new one.
Your practice task
Sanitize the synthetic configuration snippet below for documentation by instructing the AI to replace the internal API token with [REDACTED_API_KEY] and the database password with [REDACTED_DB_PASS], while keeping all variable names and DB_HOST intact.
How to do it
- Read the fake config file above.
- Ask the AI to rewrite it.
- Replace the API token with [REDACTED_API_KEY] and the password with [REDACTED_DB_PASS].
- Say: keep the variable names and DB_HOST. Press Run proof.
Practice it for free in the app. You get instant checks that show what you got right and what to fix. A lesson takes about two minutes and you can try as many times as you like.
Quick reference: Secret Sanitization & Incident Checklist
Mandatory response whenever credentials are inadvertently pasted into third-party tools.
1. Replace API tokens with [REDACTED_API_KEY] and passwords with [REDACTED_DB_PASS]. 2. Immediately rotate and revoke the live secret in provider console. 3. Audit access logs for unauthorized use during exposure window.
More lessons in this course
- Ransomware First Steps: Isolate the ComputerExecute CISA-aligned ransomware containment: isolate network interfaces immediately and escalate to incident response.
- Writing an Incident Escalation BriefCombine defanged indicators, redacted user secrets, and containment status into a shift handover brief.
- Why Attackers Target AccountsUnderstand the CIA triad and why attackers seek credentials to siphon money and corporate data.