Free to read · no account needed

9 min · safety

Secrets and pasting: what never goes in the chat

Goal: When debugging, paste redacted secret *shapes* and raw errors—treat real secrets as already compromised.

Best for: Anyone debugging with AI, connecting tools, or pasting “Build a reflex—API keys, passwords, session tokens,”

If it can unlock an account or a system, it is a secret. Redact to placeholders. If you already pasted one, rotate it. Chat history is not a password manager.

If it unlocks something, it does not belong in the chat box. Paste shapes and redacted samples; keep secrets in a password manager.

Assume chat logs are longer-lived than you think. Rotate anything that touched the box—even “temporary” keys.

Why beginners skip this

“Paste then delete the secret” feels tidy—the secret already hit the log. Pin the never-paste list first.

Step 1 — Never-paste list

  • Passwords and OTP codes
  • API keys, bearer tokens, refresh tokens
  • Private keys / .pem material
  • Connection strings with credentials
  • Customer raw PII dumps
  • Internal unreleased security details that enable abuse
I will paste redacted config. Replace secrets with YOUR_API_KEY / YOUR_PASSWORD placeholders.
Help me understand the structure only. Do not ask me to paste the real secret.

Step 2 — Config help without leakage

Example

Filled prompt

Stack trace includes connection string.
Paste shape-only redaction. Model debugs without secrets. Show before/after line.
Paste shape-only + error text; rotate if it slipped.

What good output looks like

  • Key replaced with YOUR_API_KEY (or similar) before analysis
  • Useful error text and stack lines kept intact
  • Never-paste checklist listed (keys, passwords, conn strings, tokens)
  • No request for you to re-paste the live secret
  • Debug help still works on the redacted dump

Step 3 — If you slipped

Rotate the credential in the provider console and invalidate sessions; check git history if it may have landed there, and treat the secret as compromised in that chat.

Example

Filled prompt

I almost pasted .env into chat to "debug."
Rewrite paste checklist: never-paste list, redaction pattern, what to paste instead (shape only).
Practice on a fake KEY= line—show redacted version.

What good output looks like

  • Finds email, password, and connection-string leaks in the draft
  • Returns a cleaned version that is safe to paste into chat
  • No leftover secrets in the cleaned block
  • Explains each redaction in one short line
  • Reminds you to rotate if the live values were already sent

Save this card

Card: Paste errors, never secrets—placeholder first; rotate if it slipped. Keep this beside the tool; read before you start.

Before you start

Put the scrub checklist on your desk. For “Build a reflex—API keys, passwords, session tokens, private ,” decide placeholders before the paste window opens Guide: safety-secrets-and-pasting Keep the live artifact visible the whole time. If you only have a blank box, stop and fetch the real job first

How to use this week

This week pin a never-paste list on the desk: API keys, passwords, tokens; run one fake-paste drill before work.

Rotate on contact

If a key touched chat, revoke it. “Test key” is still live when leaked.

One more pass

Re-read your Save-this-card line. If it is vague, rewrite it until a stranger could apply it.

Rotate beats delete-chat theater

Deleting a chat does not guarantee the secret is gone from every log. If a live key was pasted, rotate it in the provider console, update your app, then continue debugging with placeholders.

Error text in, secrets out

Stack traces, status codes, and redacted request paths help the model debug. Live API keys, passwords, and connection strings never do. If your paste still works after YOUR_API_KEY replacement, you redacted enough.

Example

Filled prompt

Live artifact this week for: Build a reflex—API keys, passwords, session tokens, private keys, and customer secrets nev
Name real files/people. No invented facts; label Unknowns; stop before send/delete.
Return working prompt + one pass/fail check I can mark in a minute.

What good output looks like

  • No raw PII/secrets in the paste for “Build a reflex—API keys, passwords, session tokens”
  • Placeholders used; scrub checklist visible
  • Disclosure matches how much AI actually did
  • Pass/fail: desk card updated today

Red flag

Live secrets in prompts; no rotate after a slip—placeholder first, rotate if needed.

Pitfalls

PitfallFix
“I’ll delete the message later”Rotate now; deletion ≠ un-send everywhere
Screenshots of admin consolesCrop keys; prefer redacted text
Sharing Project files with keys insideScan uploads
Example

Filled prompt

Temptation: skip the habit for safety-secrets-and-pasting to save five minutes.
Job still: Build a reflex—API keys, passwords, session
Smallest correct pass: Done visible · checkable artifact · Unknowns [?].
Boundaries: draft only; no silent send; no invented metrics.
Return: artifact + refuse-line said aloud.

What good output looks like

  • Names the shortcut refused (specific to safety-secrets-and-pasting)
  • Still delivers checkable output for “Build a reflex—API keys, passwords, session”
  • Unknowns labeled; draft-only
  • Pass/fail: refuse-line dated (safety-secrets-and-pasting #4)

Practice now

Env not chat: move one secret from chat habit to env var note (Asia/Shanghai).

Redact rehearsal: redact a fake secret in a paste before the real one (Asia/Shanghai).

Canary string: paste a fake canary; ensure it never appears in outputs you share (Asia/Shanghai).

Secrets drill: search clipboard history habit—clear after any key paste (Asia/Shanghai).

Thin-spot drill: rewrite the Save card with real nouns from your work (repo, doc, inbox). Generic placeholders fail the drill.

Tonight run the never-paste list before every paste; on a secret hit, rotate and log what almost went in.

Close the loop

Write one line: next time I paste then delete a secret, I refuse paste.

One sentence takeaway

Pin the never-paste list first; fake-paste drill passes before work.

Word-floor practice

Run the Today card once on a real artifact. Write pass/fail + never-do with date Asia/Shanghai. If you only skimmed, do not mark this guide done.

Next

PII habits · Secure coding prompts · Accounts and safety

← Back to home · Learn · Tools · Compare · Start