> ## Documentation Index > Fetch the complete documentation index at: https://standard.aiuc-1.com/llms.txt > Use this file to discover all available pages before exploring further. # A008: Prevent leakage of credentials and secrets export const InlineClock = ({city, timeZone}) => { const [time, setTime] = useState('--:--:--'); useEffect(() => { const update = () => setTime(new Intl.DateTimeFormat('en-US', { hour: '2-digit', minute: '2-digit', second: '2-digit', hour12: false, timeZone }).format(new Date())); update(); const id = setInterval(update, 1000); return () => clearInterval(id); }, [timeZone]); return
{city} {time}
; }; Implement safeguards to detect and prevent leakage of secrets in AI system inputs, outputs, logs, and credential storage
Application
Mandatory
Frequency
Every 12 months
Type
Preventative
Capabilities
Code-generation

Control activities

Typical evidence

Should include ?
A008.1 Config: Secrets detection in user inputs

Code or configuration demonstrating input-side secrets detection. For example, regex patterns or detection libraries (e.g., detect-secrets, TruffleHog rulesets) scanning user prompts and pasted context, entropy-based detection for high-randomness strings, or integration with third-party secret detection APIs. Evidence should also show the defined handling response (e.g., user warning UI, rejection logic, or alert configuration).

Typical location
Eng: User LLM input filtering logic
Capabilities
Code-generation
A008.2 Config: Secrets handling in generated code

Code, configuration, or system prompt excerpt demonstrating secrets hygiene - may include system prompt guidance directing the model toward envvar or secret-store patterns, scanning logic applied to generated files, sample generations on credential-requiring prompts showing envvar references rather than literals, or block/flag logic preventing persistence of outputs containing detected secrets.

Typical location
Engineering Code
Capabilities
Code-generation
A008.3 Config: Secure storage of user-provided credentials

Configuration showing secure handling of user-provided credentials — may include secret manager integration (e.g., AWS Secrets Manager, HashiCorp Vault, cloud-native KMS), encryption-at-rest configuration for credential storage, access scoping configuration limiting which tools or sessions can retrieve specific credentials, or code showing just-in-time credential fetching at tool-call time.

Typical location
Engineering Code Engineering Practice
Capabilities
Code-generation
May include ?
A008.4 Documentation: User-facing warnings for detected secrets

Documentation of user-facing warnings when secrets are detected in inputs — may include user-facing documentation showing warning messages displayed when credentials are detected in user input before model inference.

Typical location
Product
Capabilities
Code-generation
A008.5 Config: Secrets redaction in logs and stored artifacts

Code or configuration showing secrets redaction in stored data - may include log redaction rules alongside PII patterns (extending A006.1-style logic to credentials), masking logic applied to conversation storage, scrubbing functions in output persistence pipelines, or storage configuration showing sanitization before writes. Can be demonstrated alongside or as part of existing PII redaction controls.

Typical location
Engineering Code Logs
Capabilities
Code-generation

Organizations can submit alternative evidence demonstrating how they meet the requirement.

37.782274° N -122.392147° W FIG. A (SITE INDEX)
Artificial Intelligence Underwriting Company
Code Structural unit a. AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk. b. Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation. c. Crosswalks to AI regulations, standards, and security frameworks. d. Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.
I. Standard
II. Learn
III. Office
100 © AIUC — ALL RIGHTS RESERVED