Skip to content

Security: scthornton/prompt-database

Security

SECURITY.md

Security Policy

Responsible Use

This database contains prompt injection and adversarial attack examples for defensive security research purposes only.

Intended Use

  • Security research and analysis
  • Developing defensive mechanisms
  • Testing AI safety measures
  • Training security professionals
  • Academic research

Prohibited Use

  • Attacking production systems without authorization
  • Bypassing security controls maliciously
  • Weaponizing attacks for harmful purposes
  • Distributing to bad actors
  • Any illegal activities

Reporting Security Issues

If you discover a security vulnerability in this project or database:

Do NOT

  • Open a public GitHub issue
  • Disclose the vulnerability publicly
  • Exploit the vulnerability

DO

  1. Email the maintainer privately
  2. Provide detailed information about the vulnerability
  3. Allow reasonable time for response (72 hours)
  4. Work with maintainers on responsible disclosure

What to Include

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact assessment
  • Suggested fixes (if any)

Responsible Disclosure Timeline

  1. Day 0: Report received, acknowledgment sent
  2. Day 1-7: Initial assessment and triage
  3. Day 7-30: Fix development and testing
  4. Day 30-90: Coordinated disclosure (if applicable)

We follow industry-standard responsible disclosure practices and appreciate security researchers who help make this project safer.

Sensitive Data

This repository should NOT contain:

  • Real API keys or credentials
  • Production system details
  • Actual successful attacks against live systems
  • Personally identifiable information (PII)
  • Proprietary or confidential information

If you find any sensitive data committed by accident, please report it immediately following the process above.

Questions?

For general security questions about this project, open a GitHub issue.

For sensitive security matters, contact the maintainer directly.

There aren't any published security advisories