A shared Grok Bot exposes more than expected

The problem

A share link is useful for distributing a Bot template, but the recipient may be able to inspect and copy the Bot's configuration. Instructions that feel private inside your account are not safe merely because they are hidden from the normal conversation view.

Clean the Bot before sharing

1. Duplicate the Bot. Never sanitize the production Bot in place.
2. Remove API keys, tokens, passwords, private URLs and connector identifiers.
3. Replace client names, customer examples and internal folder paths with placeholders.
4. Remove instructions that reveal pricing rules, security procedures or confidential decision criteria.
5. Check referenced files and skills. A clean profile can still point to a private document.
6. Open the shared preview from an account with no company access and inspect what a recipient can see.

What to publish instead

Share a generic profile, task brief, expected output and approval rules. Let each recipient connect their own accounts and insert their own business context after copying it.

If a sensitive Bot was already shared

Disable the share, rotate every exposed credential, review connector activity and create a clean replacement. Deleting the link is not a substitute for rotating a secret that may already have been copied.

Security checklist · Give each Bot its own accounts