| Code | Risk category & protection measures | Status |
|---|---|---|
| LLM01 | Prompt Injection Refuses manipulation from inputs; documents & history are tagged as "data", with a system > user > data priority order; spoofed delimiters are stripped. | Protected |
| LLM02 | Insecure output handling Malicious-code screening on inputs (extended to scripts/SVG/executable links) and HTML/script sanitization on every response — even when streaming — before display. | Protected |
| LLM03 | Training data poisoning We do not train models ourselves; only verified models from reputable providers are used, so the risk is eliminated at the source. | Protected |
| LLM04 | Resource exhaustion attacks Limits on request rate, input length, response size and the number of supplementary document retrievals per turn. | Protected |
| LLM05 | Supply chain risk We integrate only reputable AI services & infrastructure providers; dependencies are centrally managed and reviewed periodically. | Protected |
| LLM06 | Sensitive information disclosure Per-organization session isolation; only user-facing fields (allow-list) are exposed and internal signals are masked before being included in answers. | Protected |
| LLM07 | Insecure plugin/extension design Document retrieval goes through two independent control layers (scoped to the current conversation + organization ownership verification), read-only mode, and call limits. | Protected |
| LLM08 | Excessive agency Impactful actions run only per approved configuration & allow-list; the document-retrieval tool is read-only, with no out-of-scope write/delete. | Protected |
| LLM09 | Overreliance on AI Confidence is assessed for each response, with a fallback plan when confidence is low and a mechanism to flag and hand off to a human. | Protected |
| LLM10 | Model theft Access limits curb mass extraction; attempts to extract the assistant's internal configuration through conversation are prevented. | Protected |