System prompt is not exposed in API responses

Returning the raw AI provider response object to the client exposes your system prompt—the complete set of instructions governing your AI's behavior—to anyone who inspects the network response. OWASP LLM01:2025 lists system prompt disclosure as a direct attack enabler: once an attacker knows your exact instructions, they can craft targeted overrides, identify specific restrictions to circumvent, and reverse-engineer your application's business logic. MITRE ATLAS AML.T0051 classifies this as reconnaissance that precedes targeted injection. CWE-200 covers the broader information exposure class. In some AI SDK versions, the response object echoes the full messages array including the system role—returning completion directly rather than completion.choices[0].message.content leaks this data to every user.

Extract only the assistant's reply content from the completion object. Return nothing else to the client.

// src/app/api/chat/route.ts
const completion = await openai.chat.completions.create({
  model: 'gpt-4o',
  messages // system prompt is in here — never send this array to the client
})

// Return only the assistant message text
const assistantReply = completion.choices[0]?.message?.content ?? ''
return Response.json({ message: assistantReply })

// Do NOT return: completion, messages, or any field that includes the system prompt

Also audit your error handling (see the no-prompt-in-errors check)—a catch block that returns error.response.data from the OpenAI SDK can echo the request payload including the system message.