Detects OpenAI ChatGPT Enterprise conversation messages that contain credentials or secrets by scanning message text against a comprehensive set of credential patterns (e.g., cloud keys, GitHub tokens, private keys, Slack/SendGrid tokens, Stripe/OpenAI/Anthropic keys, Vault/Docker tokens, JWTs, Azure storage keys). The rule excludes synthetic or documentation example keys and only raises on live secrets. It returns relevant context such as timestamp, user, and conversation metadata to aid response and remediation. The rule is mapped to credential-access and data-leakage concepts (MITRE ATT&CK T1552 Unsecured Credentials; ATLAS AML.T0055 Unsecured Credentials and AML.T0057 LLM Data Leakage) and is intended to detect potential exfiltration through chats. Setup requires the OpenAI ChatGPT Enterprise integration to feed compliance logs into Elasticsearch. Triage guidance covers distinguishing live secrets from samples, identifying user/conversation context, and checking for shares, downloads, or downstream Codex activity. Remediation emphasizes rotating live credentials, removing residual copies from shared conversations, and restricting access to logs containing message text.