← Control library
S03 · Integration security
Secrets, dependencies and execution boundaries
Leaked credentials or unsafe dependencies turn agent execution into a path to wider systems.
Requirement
Keep secrets outside prompts and code, scan dependencies and isolate generated commands or code with explicit resource limits.
Expected evidence
- Secret-management and rotation records.
- Dependency inventory and sandbox policy.
Proposed verification
- Inspect prompts, logs and repositories for exposed secrets.
- Run a benign escape and resource-exhaustion test in the authorized sandbox.
Limit
A clean scan is point-in-time and does not cover unknown vulnerabilities.