Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFixture leakage occurs when expected test values are included in an AI coding prompt, giving a model a chance to copy known answers instead of implementing the rule that produces them. A small local Python script can reveal some literal overlap before you send a prompt—but it cannot prove the prompt is safe.
What you will build—and what it can catch
The exercise is a local preflight check: scan pytest-style assert ... == ... lines, collect expected fragments, then replace matching fragments in a prompt with [[REDACTED_EXPECT]]. It uses Python’s standard library; the tutorial author reports running it with Python 3.11, without pip or a notebook.
As an Amazon Associate I earn from qualifying purchases.
The underlying issue is dataflow. Test source contains literals, your prompt is another string, and a shared substring can expose an expected answer. As the tutorial’s author, Alex Chen, puts it: “Fixture leakage is not a vibe-coding slogan. It is a dataflow bug.”
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →This scrubber is a teaching gate, not a general-purpose prompt-security system. It detects some text overlap; it does not establish that a prompt is safe or that a model will generalize correctly.
#1 Best Overall
Build and run the scrubber
Save the following as tiny_prompt_scrubber.py. This deliberately narrow implementation looks for quoted string literals on equality assertions, filters out fragments shorter than two characters, and replaces longer matches in the prompt.
import re
ASSERT_RE = re.compile(r"asserts+.+?==s*(?P<expected>.+?)s*$")
STRING_RE = re.compile(r"(['"])(.*?)1")
def expected_fragments(test_source: str) -> list[str]:
fragments = []
for line in test_source.splitlines():
match = ASSERT_RE.search(line)
if not match:
continue
expected = match.group("expected")
fragments.extend(value for _, value in STRING_RE.findall(expected))
return sorted({value for value in fragments if len(value) >= 2}, key=len, reverse=True)
def scrub(prompt: str, fragments: list[str]) -> str:
for fragment in fragments:
prompt = prompt.replace(fragment, "[[REDACTED_EXPECT]]")
return prompt
if __name__ == "__main__":
test_source = '''
assert result.name == "Mira Chen"
assert result.label == "North-Star"
'''
prompt = "Write a function that returns Mira Chen for this record and uses North-Star as its label."
fragments = expected_fragments(test_source)
print("Expected fragments:", fragments)
print("Before:", prompt)
print("After:", scrub(prompt, fragments))Run it from a terminal with python tiny_prompt_scrubber.py (or python3 tiny_prompt_scrubber.py where that is the Python 3 command). The output lists the extracted fragments and shows each matching occurrence in the prompt replaced by the marker.
Predict which strings will leak
For the example, the expected fragments are Mira Chen and North-Star. Because replacements are sorted longest first, a longer expected value is handled before any shorter fragment that might occur inside it. The script replaces substrings wherever they occur, not only when they appear as complete words or quoted values.
That behavior is useful for spotting overlap, but it can also change unrelated prose. If the expected value is the letter a, unrestricted replacement could damage many ordinary words. The two-character minimum avoids that particular flood of replacements; it also means a one-character expected value will not be detected. This is a readability trade-off, not a security threshold.
Understand the limits before trusting the result
The regular expression is intentionally simple and does not cover many normal ways tests express expectations. It can miss pytest.mark.parametrize, doctests, values stored in helper variables, and comparisons such as assert result.name == person. It also works line by line and extracts quoted strings rather than understanding Python expressions.
- A redacted match means a literal fragment appeared in both the selected assertion text and the prompt; it does not say whether the rest of the prompt is safe.
- No redacted match does not mean no expected data was exposed. The test pattern may be outside the regex’s coverage, or an expected value may be shorter than the filter allows.
- Successful generation would not validate the scrubber. A model can still produce a wrong implementation or infer an answer from other context.
Do not use this script as a production redaction filter, or to handle secrets or sensitive student data. Its narrow pattern matching and substring replacement are not suitable guarantees for those cases.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose a stronger way to separate answers from prompts
Parse Python source when you need structure
Python’s official ast documentation describes ast.parse as a way to parse source into an abstract syntax tree. Walking that tree can support more structured extraction than searching lines with a regular expression, but you still need logic for the specific test constructs and values you want to identify. The documentation also cautions that successful parsing alone does not guarantee the source can be compiled or executed. An AST is a parsing route, not a leakage-prevention guarantee.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Keep expected values out of the prompt
A more direct data-handling improvement is to store expected values in a JSON fixture that never enters the prompt. If the model does not receive the answer data, this particular route for copying fixture values is removed. Keep the fixture available to your local tests, and give the model the task and necessary input format without including the expected outputs.
What the demonstration showed
Chen reports that the original prompt exposed two fixture strings and that the scrubbed prompt exposed zero of those two. The author also reports that a later generated draft failed on a second input because it assumed a comma rather than a dash, after which delimiter handling was fixed. These are observations from one tutorial demonstration, not a benchmark or evidence of general effectiveness; the author reports no token benchmark or timing result.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
