TPEE Toptronic® Prompt Engineering Editor

26. Security Prompting

Use AI to find risks without exposing secrets or creating unsafe instructions.

By Jacques Botte, founder of Toptronic®. Last updated 12 September 2026.

The lesson

Security prompts must avoid sharing passwords, API keys, private certificates, customer data, and undisclosed vulnerabilities with external tools.

Ask for threat models, attack surfaces, data-flow diagrams, input validation checks, dependency risks, and mitigation priorities.

AI security findings are suggestions. A human must verify exploitability and fixes.

Check yourself

Question 1: What must not be pasted into external AI tools?
  1. Passwords, API keys, private certificates, and customer data — correct
  2. Public documentation links
  3. General concepts
  4. Empty examples

Answer: Passwords, API keys, private certificates, and customer data

Secrets and sensitive data must be protected.

Question 2: What should a security prompt ask for?
  1. Only slogans
  2. No risks
  3. Only UI colors
  4. Threat model, attack surface, validation checks, dependency risks, mitigations — correct

Answer: Threat model, attack surface, validation checks, dependency risks, mitigations

Security review needs structured risk analysis.

Question 3: How should AI security findings be treated?
  1. As production fixes
  2. As legal sign-off
  3. As suggestions requiring human verification — correct
  4. As automatically proven exploits

Answer: As suggestions requiring human verification

Security findings must be validated.

← Previous lesson · All 83 lessons · Next lesson →

The full course — 83 lessons and 249 quiz questions — ships inside the app. Get TPEE to study it offline.