How should an application handle system prompt leakage?

I classify prompt components by operational sensitivity and store them in versioned access-controlled configuration, not inline with secrets. Traces and support tooling reveal only the prompt identity or approved redacted view to most operators. If disclosure exposes a real exploit path, the incident is fixed at the missing boundary and the prompt is rotated as defense in depth, rather than declaring rotation alone a remediation. Evaluations assume the attacker already knows the instructions and verify that deterministic controls still hold.