Find sensitive data in LLM prompts (OWASP LLM02)

Find method parameters and getter or record accessor calls whose names mark them as sensitive (passwords, API keys, tokens, social security numbers, payment card numbers, and so on) flowing into an LLM prompt through the OpenAI, Anthropic, Azure AI Inference, LangChain4j, or Spring AI Java SDKs. Data sent to a hosted model leaves the application's trust boundary, can be retained by the provider, and can be echoed back to other users. Remove or mask the value before it reaches the prompt; a call to a method whose name starts with mask, redact, anonymize, tokenize, encrypt, or a similar verb is treated as doing so.