Supported hardcoded system-prompt pattern appears in executable client content
ShipReady found a supported hardcoded system-message or systemPrompt pattern in static executable page content or fetched JavaScript.
Why it matters
Hardcoded client content is visible to people who can inspect the delivered page and scripts, so it is useful to decide deliberately which instructions belong in public client assets.
How ShipReady detects it
What it inspects
ShipReady reads executable static content from the page and fetched JavaScript. It excludes inert page prose and code samples from the page portion of this check.
What triggers a finding
The rule triggers for either a role: system message followed by a literal content string of at least 40 characters or a systemPrompt-style variable assigned a literal string of at least 40 characters.
What the evidence shows
A supported hardcoded system-prompt pattern appeared in the executable client content inspected by ShipReady. The prompt text is not retained in the report.
Limits of this check
ShipReady does not execute the client code or model, establish that a live model uses the text, assess the prompt's effectiveness, or determine whether it contains sensitive information. It does not prove browser-side AI calls or exposed credentials.
How to fix it
Review the instruction as public client content
Decide whether the detected instruction is intended to be visible in delivered client code and remove or relocate it when it is not.
Keep non-public instructions in trusted code
Where the product requires instructions to remain non-public, move their construction and the associated model interaction to server-side code.
How to verify the change
Inspect deployed executable assets
Search the deployed executable page content and JavaScript for the supported system-message or systemPrompt shape after release.
Expected: Only instructions intentionally delivered to clients remain in executable public assets.