Security, Prompt Injection & Data Privacy

39 lessons in AI Engineering / Working with LLMs

• XSS from LLM HTML OutputCode Quiz
• Allow-List Before Downstream ActionCode Quiz
• Blocking Sensitive Data ExfiltrationCode Quiz
• Guarding Against Jailbreak OverridesCode Quiz
• Sandboxing Model-Generated CodeCode Quiz
• Sanitizing URLs to Prevent SSRFCode Quiz
• Opting Out of Provider TrainingCode Quiz
• Trusting Model Output for AuthorizationCode Quiz
• Masking PII in Model OutputCode Quiz
• Excessive Agency and Confused DeputySlides / Video
• OWASP Top 10 for LLM AppsSlides / Video
• GDPR & HIPAA for LLM DataSlides / Video
• Vendor Data Retention & Opt-OutSlides / Video
• Injection Risks in RAG DocumentsSlides / Video
• Redact PII Before EmbeddingCode Quiz
• Least-Privilege Design for Tool AccessSlides / Video
• Trusted Instructions vs Untrusted DataSlides / Video
• Over-Privileged Tool AccessCode Quiz
• Ungated Tool ExecutionCode Quiz
• Logging API Keys in PromptsCode Quiz
• Logging Raw Sensitive User DataCode Quiz
• Indirect Injection via Retrieved ContentCode Quiz
• Wrong Role for User DataCode Quiz
• Treating Documents as InstructionsCode Quiz
• Encryption In Transit and At RestQuiz
• Trusted vs Untrusted Input SeparationQuiz
• Excessive Agency in AgentsQuiz
• Delimiting Untrusted ContentQuiz
• Data Exfiltration via OutputsQuiz
• Direct vs Indirect Prompt InjectionQuiz
• Preventing Secret Leakage in PromptsQuiz
• System Prompt LeakageQuiz
• Multi-Tenant Data IsolationQuiz
• Provider Data Retention PoliciesQuiz
• RAG Injection via Retrieved DocsQuiz
• Least-Privilege for LLM ResourcesQuiz
• Data Exfiltration via LLM OutputsSlides / Video
• System Prompt Leakage and ExtractionSlides / Video
• Direct vs Indirect Prompt InjectionSlides / Video