Thuta Learning
Search
AdvancedAIbeginner

The Secret Hiding in Your Notes

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

  • Understand secrets hiding in your notes without any of the scary mystique
  • Get hands-on practice trying it yourself
  • Learn to dodge hallucination and secret leaks with a smile

RAG repeats back whatever's in your files. If a key, an ID number, or a phone number is sitting in there, it'll politely leak it right out.

Let's think about this for a second

Chatbot hallucination is leaking a wrong fact. RAG leak is leaking a real secret. The second one stings a lot more. So check what you're feeding it before you feed it. Don't include .env files, passwords, student ID numbers, or medical records. Writing "don't show the address / phone / key" in the prompt isn't nearly enough. If you don't put trash in, you don't need to clean up a mess later.

Let's connect it to everyday life

For Ask Your Notes, only use dummy lesson data. Don't put in your real diary, chats with friends, or an API key. In the logs, only keep the short question itself. Don't push your full notes to GitHub. If a user asks "what's the API key," refuse — even if it's sitting right there in the file, don't hand it back. That's your extra lock.

Let's try it hands-on together

text
Never index
- .env, passwords, tokens
- student scores, phone numbers
- other people's private chats

If asked for a secret → refuse, even if a file contains it
You should see
You'll be able to set secret-handling rules for a RAG project.

5-minute try-it

List 5 files you shouldn't feed in. For each one, write a single line explaining why it's risky.

One quick warning

If you share your RAG demo with a friend, whatever's inside those files reaches them too. Only share dummy notes.

Easy traps

  • Dropping your real diary straight into the demo
  • Thinking writing "don't reveal this" in the prompt makes you safe

Now try it yourself

List 5 files you shouldn't feed in. For each one, write a single line explaining why it's risky.

You'll know it worked when: You'll be able to set secret-handling rules for a RAG project.

The Secret Hiding in Your Notes | Thuta Learning