{"course":{"slug":"choosing-your-tools","title":"Choosing and Using the Tools","url":"https://addaly.com/learn/choosing-your-tools","level":"beginner","track":"work"},"lesson":{"slug":"secrets-and-what-not-to-paste","title":"Secrets, and what not to paste","url":"https://addaly.com/learn/choosing-your-tools/secrets-and-what-not-to-paste","position":54,"of":76,"minutes":7,"answer":"Never paste credentials or identity numbers at any tier, substitute placeholder values before copying config files and logs, and if it happens anyway rotate the secret first: deletion limits exposure but does not undo storage.","keyIdea":"Never paste credentials or identity numbers at any tier, substitute placeholder values before copying config files and logs, and if it happens anyway rotate the secret first: deletion limits exposure but does not undo storage."},"body":{"format":"markdown","text":"## The short list\n\nSome things should never go into a chat box with any provider, on any tier, under any terms, because the cost of being wrong is out of proportion to the convenience.\n\n- **Passwords and passphrases.** Yours or anyone else's.\n- **API keys, tokens and connection strings.** Including the ones sitting in a config file you paste to ask why the file is not working.\n- **Private keys and certificates.**\n- **Full payment card numbers, bank details, government identity numbers.**\n- **Anything covered by a specific legal duty** you cannot discharge: sealed material, some categories of health and criminal record data, anything under a court order.\n- **Whole databases of other people's personal information.**\n\nThe reason is not that a provider is likely to misuse them. It is that this material multiplies: it lands in conversation history, in backups, in an abuse-monitoring store, in a screenshot somebody takes, in an export you share with a colleague. Every copy is another chance, and none of them was necessary, because the model did not need the secret to answer the question.\n\n## The paste that catches developers\n\nDebugging a configuration file or an error log is one of the best uses of these tools, and it is the most common way keys leak.\n\n```\n# what people paste\nDATABASE_URL=postgres://admin:hunter2@db.internal:5432/customers\nSTRIPE_KEY=sk_live_51H...\nTraceback: connection refused\n\n# what the model needs\nDATABASE_URL=postgres://USER:PASS@HOST:5432/DBNAME\nTraceback: connection refused\n```\n\nThe second version gets exactly the same answer. Make the substitution automatic: when you copy a config file or a log, replace the values before you leave the clipboard. It takes five seconds and it is the difference between a helpful conversation and a leaked credential.\n\nScreenshots of a terminal are the same problem with none of the opportunity to edit. Terminal windows show environment variables, hostnames, usernames and paths that identify your employer. Crop, or paste text you have cleaned.\n\n## Code, and what it reveals\n\nSource code carries more than logic: internal hostnames, table structures, business rules, customer names in test fixtures, and comments people wrote when they were annoyed. Before pasting a file from work, look at it as a document rather than as code.\n\nIf your employer has a policy, it governs. If your employer has no policy and you are pasting proprietary code into a consumer service, you are making a decision on their behalf that they may not have made.\n\n## After an accidental paste\n\nIt happens to careful people. The response, in order:\n\n1. **Rotate the secret immediately.** A key, a password, a token: revoke and reissue. This is the only step that fixes anything, and it takes a minute.\n2. **Delete the conversation.** Worth doing. It limits further exposure and it does not undo storage that has already happened.\n3. **Check the retention terms.** You now know how long the copy persists.\n4. **If it was somebody else's data, tell whoever is responsible.** Many organisations have a reporting duty with a clock on it, and the clock started when it happened rather than when you mentioned it.\n5. **Write down what happened.** One paragraph. If it is ever asked about, the contemporaneous note is what makes it a handled incident rather than a concealed one.\n\nNobody has ever been in less trouble for reporting this quickly. The instinct to hope it does not matter is understandable and it is exactly backwards: the small immediate action is cheap, and the delay is what turns it into a serious matter.\n\n## Scanning before you share\n\nIf you regularly paste code or configuration, install a scanner once. **gitleaks** and **trufflehog** are free, run in a second, and detect the common key formats. Running one over a file before you copy it is a five-second habit that catches the credential you had forgotten was in there.\n\nThe same tools run as a pre-commit hook on a repository, which catches the other version of this mistake. Neither is specific to AI tools; both belong to any working life where secrets and text move around, and this is one more reason to have them.\n\n## The habit that prevents most of it\n\nKeep secrets out of the things you paste from, rather than remembering to remove them at the moment of pasting. Environment variables instead of literals in config files, placeholder values in examples, and no credentials in test fixtures. Then the careless paste, when it eventually happens, contains nothing worth having."},"check":{"question":"Someone pastes a config file containing a live API key while debugging, then deletes the conversation. Why is the deletion not the important step?","options":[{"text":"Because deleted conversations remain visible in the account's export until the retention period expires.","correct":false,"tempting":"Focuses on where a copy is visible, when the decisive fact is that the key itself is now usable by anyone who has seen it."},{"text":"The key may already sit in retention or backup systems; only rotating it removes the exposure.","correct":true},{"text":"Because deletion requests are processed asynchronously and may take up to thirty days to complete.","correct":false,"tempting":"Treats a processing delay as the issue; even instant deletion would leave the key compromised."},{"text":"Because the model has already seen the key and could reproduce it in a later conversation.","correct":false,"tempting":"Assumes single conversations enter the weights, which is not how training works and misses the immediate risk entirely."}]},"prev":{"slug":"redaction-that-works","title":"Redaction that actually works","url":"https://addaly.com/learn/choosing-your-tools/redaction-that-works"},"next":{"slug":"accounts-sharing-and-devices","title":"Accounts, sharing and devices","url":"https://addaly.com/learn/choosing-your-tools/accounts-sharing-and-devices"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Secrets, and what not to paste', in Choosing and Using the Tools. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/choosing-your-tools/secrets-and-what-not-to-paste (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Secrets, and what not to paste","courseTitle":"Choosing and Using the Tools","module":{"index":6,"slug":"data-terms-and-law","title":"Data, terms and the law"},"answer":null,"keyIdea":"Never paste credentials or identity numbers at any tier, substitute placeholder values before copying config files and logs, and if it happens anyway rotate the secret first: deletion limits exposure but does not undo storage.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"the-short-list","runs":[{"text":"The short list"}]},{"t":"p","runs":[{"text":"Some things should never go into a chat box with any provider, on any tier, under any terms, because the cost of being wrong is out of proportion to the convenience."}]},{"t":"ul","items":[[{"text":"Passwords and passphrases.","b":true},{"text":" Yours or anyone else’s."}],[{"text":"API keys, tokens and connection strings.","b":true},{"text":" Including the ones sitting in a config file you paste to ask why the file is not working."}],[{"text":"Private keys and certificates.","b":true}],[{"text":"Full payment card numbers, bank details, government identity numbers.","b":true}],[{"text":"Anything covered by a specific legal duty","b":true},{"text":" you cannot discharge: sealed material, some categories of health and criminal record data, anything under a court order."}],[{"text":"Whole databases of other people’s personal information.","b":true}]]},{"t":"p","runs":[{"text":"The reason is not that a provider is likely to misuse them. It is that this material multiplies: it lands in conversation history, in backups, in an abuse-monitoring store, in a screenshot somebody takes, in an export you share with a colleague. Every copy is another chance, and none of them was necessary, because the model did not need the secret to answer the question."}]},{"t":"h2","id":"the-paste-that-catches-developers","runs":[{"text":"The paste that catches developers"}]},{"t":"p","runs":[{"text":"Debugging a configuration file or an error log is one of the best uses of these tools, and it is the most common way keys leak."}]},{"t":"code","lang":"","label":"Text","text":"# what people paste\nDATABASE_URL=postgres://admin:hunter2@db.internal:5432/customers\nSTRIPE_KEY=sk_live_51H...\nTraceback: connection refused\n\n# what the model needs\nDATABASE_URL=postgres://USER:PASS@HOST:5432/DBNAME\nTraceback: connection refused"},{"t":"p","runs":[{"text":"The second version gets exactly the same answer. Make the substitution automatic: when you copy a config file or a log, replace the values before you leave the clipboard. It takes five seconds and it is the difference between a helpful conversation and a leaked credential."}]},{"t":"p","runs":[{"text":"Screenshots of a terminal are the same problem with none of the opportunity to edit. Terminal windows show environment variables, hostnames, usernames and paths that identify your employer. Crop, or paste text you have cleaned."}]},{"t":"h2","id":"code-and-what-it-reveals","runs":[{"text":"Code, and what it reveals"}]},{"t":"p","runs":[{"text":"Source code carries more than logic: internal hostnames, table structures, business rules, customer names in test fixtures, and comments people wrote when they were annoyed. Before pasting a file from work, look at it as a document rather than as code."}]},{"t":"p","runs":[{"text":"If your employer has a policy, it governs. If your employer has no policy and you are pasting proprietary code into a consumer service, you are making a decision on their behalf that they may not have made."}]},{"t":"h2","id":"after-an-accidental-paste","runs":[{"text":"After an accidental paste"}]},{"t":"p","runs":[{"text":"It happens to careful people. The response, in order:"}]},{"t":"ol","start":1,"items":[[{"text":"Rotate the secret immediately.","b":true},{"text":" A key, a password, a token: revoke and reissue. This is the only step that fixes anything, and it takes a minute."}],[{"text":"Delete the conversation.","b":true},{"text":" Worth doing. It limits further exposure and it does not undo storage that has already happened."}],[{"text":"Check the retention terms.","b":true},{"text":" You now know how long the copy persists."}],[{"text":"If it was somebody else’s data, tell whoever is responsible.","b":true},{"text":" Many organisations have a reporting duty with a clock on it, and the clock started when it happened rather than when you mentioned it."}],[{"text":"Write down what happened.","b":true},{"text":" One paragraph. If it is ever asked about, the contemporaneous note is what makes it a handled incident rather than a concealed one."}]]},{"t":"p","runs":[{"text":"Nobody has ever been in less trouble for reporting this quickly. The instinct to hope it does not matter is understandable and it is exactly backwards: the small immediate action is cheap, and the delay is what turns it into a serious matter."}]},{"t":"h2","id":"scanning-before-you-share","runs":[{"text":"Scanning before you share"}]},{"t":"p","runs":[{"text":"If you regularly paste code or configuration, install a scanner once. "},{"text":"gitleaks","b":true},{"text":" and "},{"text":"trufflehog","b":true},{"text":" are free, run in a second, and detect the common key formats. Running one over a file before you copy it is a five-second habit that catches the credential you had forgotten was in there."}]},{"t":"p","runs":[{"text":"The same tools run as a pre-commit hook on a repository, which catches the other version of this mistake. Neither is specific to AI tools; both belong to any working life where secrets and text move around, and this is one more reason to have them."}]},{"t":"h2","id":"the-habit-that-prevents-most-of-it","runs":[{"text":"The habit that prevents most of it"}]},{"t":"p","runs":[{"text":"Keep secrets out of the things you paste from, rather than remembering to remove them at the moment of pasting. Environment variables instead of literals in config files, placeholder values in examples, and no credentials in test fixtures. Then the careless paste, when it eventually happens, contains nothing worth having."}]}],"check":{"question":[{"text":"Someone pastes a config file containing a live API key while debugging, then deletes the conversation. Why is the deletion not the important step?"}],"options":[{"text":[{"text":"Because deleted conversations remain visible in the account’s export until the retention period expires."}],"correct":false,"tempting":[{"text":"Focuses on where a copy is visible, when the decisive fact is that the key itself is now usable by anyone who has seen it."}]},{"text":[{"text":"The key may already sit in retention or backup systems; only rotating it removes the exposure."}],"correct":true,"tempting":null},{"text":[{"text":"Because deletion requests are processed asynchronously and may take up to thirty days to complete."}],"correct":false,"tempting":[{"text":"Treats a processing delay as the issue; even instant deletion would leave the key compromised."}]},{"text":[{"text":"Because the model has already seen the key and could reproduce it in a later conversation."}],"correct":false,"tempting":[{"text":"Assumes single conversations enter the weights, which is not how training works and misses the immediate risk entirely."}]}],"order":[2,0,1,3],"why":null},"prev":{"slug":"redaction-that-works","title":"Redaction that actually works","minutes":8},"next":{"slug":"accounts-sharing-and-devices","title":"Accounts, sharing and devices","minutes":7}}}