Filter by owner first, then scan the reply
The marker and the key are made up. The scan shows what regular expressions catch and what they miss.
A model repeats what is in its prompt, so anything you put there can come out. Keep secrets out of prompts, filter data by owner before it is retrieved, scan replies, and design so that a leak exposes nothing important.
Change the code and press Run (Ctrl+Enter). Predict what will happen first, then break it on purpose and read what changes. Your edits are saved and match the lesson page.
Ready for more? This phase has 5 hands-on exercises with automatic checks.
Practice questions
Write the code in the editor, run it, then open the model answer to compare.
Write filter_docs(docs, user) where each doc is (owner, text); return the texts the user owns. Test with Bob and Alice.
Write has_leak(reply, canary) that returns True if the canary appears in the reply, ignoring case and ignoring dashes and spaces in the reply. Test it with the exact canary and a spaced version.
Explain it without notes
Why can't you keep a secret in a system prompt?
How should an app enforce 'users can only see their own documents' with a model in the middle?
What is a canary and what does it detect?
What should you check about a model provider before sending user data to it?
Expected output
retrieval for alice 'invoice': Alice invoice total: 120
retrieval for bob 'invoice': Bob invoice total: 80
retrieval for bob 'shipping': (nothing)
reply 1: sent
reply 2: withheld (system prompt marker)
reply 3: withheld (key-like string)
reply 4: sent