# GRD-008: Detect secrets, technical configuration and security-operations detail


- Area: Runtime Guardrails

- Verification: Live test
- OWASP adoption tier: AT0–AT4
- Formerly: DAT-012
- URL: /r/GRD-008

**Acceptance criteria:** Detect standard and homegrown keys, API tokens, credentials, connection strings, internal hostnames, network ranges and infrastructure config, plus narrative incident reports and customer authentication or session detail.

**Why it matters:** One leaked credential or network detail can turn an AI prompt into a breach.

**How to verify:** Standard and homegrown secrets, hostnames and incident details are detected in pilot prompts.

**OWASP adoption context:** Secrets and configuration details can enter prompts across the listed employee AI settings, including technical and code-agent work.

**Mappings:**
- NIST CSF 2.0: PR.DS-02, DE.CM-09 — Detection of credentials, configuration and security narratives provides runtime/data-monitoring evidence and inputs to in-transit protection. A finding alone does not stop disclosure.
- SOC 2: CC6.7, CC6.1; ISO 27001: A.8.12, A.5.17 — Credential and infrastructure findings can feed leakage controls and protect authentication information. Detection does not manage credential allocation, storage, rotation or revocation; incident narratives are not automatically credentials.
ISO/IEC 27001: A.8.12: Use an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response.
- ISO 42001: A.9.2 — Detecting secrets and security-operations detail supplies a specific input to responsible AI-use procedures. This link requires documented prohibited-input rules and an operated disposition; the detector does not define or operate the whole process.