---
title: "Data and secrets · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets
updated: 2026-10-20
licence: "All rights reserved"
---

# Data and secrets

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Keep keys out of code and pages. Show short errors, close debug doors and hidden files, and send back only the data each request needs.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets`.

## Required

- [Keep secrets out of code](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code): Never write a password, key or token into code, settings files in the repo, or its history.
- [Keep secrets out of the browser](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-browser): Send no private key to the browser. Anything in a page, script or source map can be read by anyone.
- [Show short errors](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/short-errors): Show visitors a short error with a reference number. Keep stack traces, queries and file paths in the server log.
- [Close debug and admin doors](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/close-debug-doors): Remove debug, test and status tools from production, or put them behind a login and a private network.
- [Serve no hidden files](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/no-hidden-files): Serve only the files you meant to publish. Never serve version control folders, settings files, backups or folder listings.
- [Return only the fields needed](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/only-needed-fields): Each API reply returns only the fields the caller needs and may see. Never send a whole database record and let the page hide the rest.
- [Keep private data out of logs and addresses](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-data-out-of-logs): Never put passwords, tokens, card numbers or personal details in addresses or logs.
- [Encrypt data on the wire and on disk](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/encrypt-data): Encrypt every connection, including those between your own servers. Encrypt stored personal data and backups.
- [Give each key the least power](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/least-privilege-keys): Give every key, account and service only the access it needs. Replace keys at least every 90 days, and at once after a leak or when someone with access leaves.
- [Keep storage buckets private](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-storage-buckets): Keep cloud storage buckets and file shares private. Hand out short-lived signed links for single files instead of public folders.
- [Keep card numbers off your servers](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/hosted-payment-fields): Never let card numbers reach your servers or your own scripts. Take payments through the provider's hosted checkout or its embedded payment fields.

- Previous: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Next: [Requests and files](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files)
- [All chapters](https://agentwranglers.se/playbook/adversarial-testing)