Answer 10 questions about your chatbot's defenses. Score 80% or higher and you'll unlock an embeddable "Prompt-Injection Tested" badge for your site — with a backlink to this test, so every badge spreads the word.
Yes. A structured self-assessment of your chatbot's defenses — input validation, system-prompt hardening, indirect-injection handling, output filtering, least-privilege tools, human approval for irreversible actions, monitoring, red-teaming, and incident response — gives a meaningful readiness signal. This page scores ten such controls; pass 80% and you can embed a Prompt-Injection Tested badge. It is self-assessed, not an independent certification.
For each control: Yes = fully implemented (2 pts), Partial = started or inconsistent (1 pt), No = not in place (0 pts). Be honest — the badge is only as credible as your answers.
Copy this snippet into your site's HTML. It links back to this test so visitors can verify what the badge means.
Honest scope: this is a self-assessment questionnaire, not a penetration test or certification. Passing 80% means your declared controls are strong — it does not mean attackers can't find a way in. Pair it with real adversarial red-teaming.
What this page does NOT do: it does not attack your chatbot, inspect your code, or verify any of your answers.
Yes. A structured self-assessment of your chatbot's defenses — input validation, system-prompt hardening, indirect-injection handling, output filtering, least-privilege tools, human approval, monitoring, red-teaming, and incident response — gives a meaningful readiness signal, though it is not a substitute for adversarial testing by specialists.
No. The badge reflects a self-assessment you complete on this page. It is not an independent security certification, audit, or guarantee — nobody verified your answers. Treat it as a public commitment to prompt-injection hygiene, not proof of invulnerability.
Indirect prompt injection hides malicious instructions in content the model reads — a webpage, document, email, or tool output — rather than in the user's own message. It accounts for over 55% of observed prompt-injection attacks in 2026 and succeeds more often because the instructions arrive via trusted sources.
Deterministic controls, not filters: least-privilege tool permissions, human approval for irreversible actions, strict output handling, and isolation of untrusted content. Filters are probabilistic and attackers routinely bypass them — containment limits what a hijacked model can actually do.