{"course":{"slug":"how-software-changed","title":"How Software Development Changed","url":"https://addaly.com/learn/how-software-changed","level":"intermediate","track":"work"},"lesson":{"slug":"what-leaves-the-building","title":"What leaves the building when you type","url":"https://addaly.com/learn/how-software-changed/what-leaves-the-building","position":71,"of":87,"minutes":9,"answer":"Retention and training are separate questions answered differently by consumer and business tiers, and since you cannot verify either claim.","keyIdea":"Retention and training are separate questions answered differently by consumer and business tiers, and since you cannot verify either claim, the only control you actually hold is minimising what goes into context in the first place."},"body":{"format":"markdown","text":"## Know what is actually sent\n\nA completion request is not just the line you are on. Depending on the tool it may include the surrounding file, other open tabs, files the tool judged related, a repository index, your recent edits, the last several terminal commands, and the diff you are about to commit.\n\nThe first useful action is to find out. Most tools document their context assembly somewhere unglamorous, and some will show you the request. If you cannot find out what is sent, assume the whole working tree, because that is the direction the products are moving.\n\n## The two questions that matter\n\nThey are separate and people routinely conflate them.\n\n**Is it retained?** How long does the provider keep the request, in logs or otherwise?\n\n**Is it trained on?** Does it enter a training set for a future model?\n\nThe answers differ sharply by tier, and almost always in the same direction: consumer and free tiers are permissive, business and enterprise tiers are restrictive and contractual. Many free tiers train on input by default with an opt-out buried in settings; most paid business tiers commit not to, in the agreement rather than the marketing page.\n\nRead the data processing addendum, not the landing page. The landing page says \"your data is secure\", which is not a statement about retention or training. The addendum says how long, where, and to whom.\n\n## The concrete leaks\n\nThese are the ones that actually happen, and none of them involve a sophisticated attacker.\n\n- `.env` open in a tab while completions run in the next file.\n- A test fixture built from a production export, with real names, real addresses and a real card BIN.\n- A connection string pasted into a chat to ask why it fails.\n- A stack trace pasted whole, carrying a session token in a header dump.\n- A migration script containing a customer identifier used as an example.\n\nThe pattern is that the secret was not in the file you were thinking about.\n\n## Controls that work\n\n**Do not have real secrets in the repository at all.** This is the only control that fully survives a mistake. Secrets live in a manager (your cloud's own, or `sops` with age, or Vault) and reach the process as environment variables at run time. `direnv` with an untracked `.envrc` is a free version that works on a laptop.\n\n**Use the tool's ignore file.** Most assistants honour a per-tool exclusion list alongside `.gitignore`: the name differs by product but the pattern is universal. Put `.env*`, `*.pem`, `secrets/`, fixture directories and anything containing production data in it. Verify it works rather than assuming, by checking whether completions still reference an excluded file's contents.\n\n**Scan before the commit, not after the push.** `gitleaks` and `trufflehog` are free and run as a pre-commit hook in under a second on a normal diff.\n\n```bash\ngitleaks protect --staged --redact\n```\n\n**Generate the fixtures.** Test data built by a factory (Faker or equivalent, free in every language) never contains a real person. Exporting from production \"just for this test\" is the most common route by which customer data ends up in a prompt.\n\n**Rotate what was exposed.** If a live credential was in context, it is exposed. Not probably, not pending investigation. Rotate it and move on; the deliberation costs more than the rotation.\n\n## The regulatory layer, briefly and without advice\n\nIf a prompt contains personal data, sending it to a provider is a processing activity, and in most data-protection regimes that requires a lawful basis, a processor agreement, and a record. Code containing customer data is customer data: the fact that it is inside a Python file changes nothing.\n\nRegimes differ in ways that matter operationally: where processing may occur, what must be disclosed, how long records are kept. This course is not the place to resolve any of that and cannot advise you. The operational point is narrower and holds everywhere: **you cannot verify a retention claim, so the only control you truly hold is what you send.** Data minimisation is not a legal strategy, it is the one thing that does not depend on somebody else keeping a promise.\n\n## Your own logs are part of this\n\nTeams that route requests through an internal gateway for cost control usually log the full prompt. That log is now a store of source code and whatever was in context, sitting in your observability stack with whatever retention that has, readable by whoever can read dashboards.\n\nIf you build a gateway, decide the retention deliberately, redact on the way in rather than on the way out, and put the log behind the same access controls as the source it contains. Most teams discover this log exists during an audit."},"check":{"question":"A team moves to an enterprise tier whose contract forbids training on their inputs. What risk does this leave untouched?","options":[{"text":"Nothing significant; a contractual no-training commitment is the control that matters for source code.","correct":false,"tempting":"Treats one of the two questions as covering both, and ignores the team's own infrastructure."},{"text":"Generated code may still reproduce training data from other customers, creating a licensing exposure.","correct":false,"tempting":"A real concern but unrelated to what this control was meant to address."},{"text":"Retention is a separate question, and the team's own gateway logs may store every prompt anyway.","correct":true},{"text":"Enterprise contracts typically exclude completions from their terms, covering only chat conversations.","correct":false,"tempting":"Invents a contractual carve-out rather than identifying the structural gap."}]},"prev":{"slug":"vulnerabilities-that-arrive-by-default","title":"Insecure defaults, inherited","url":"https://addaly.com/learn/how-software-changed/vulnerabilities-that-arrive-by-default"},"next":{"slug":"instructions-hidden-in-data","title":"Instructions hidden in the things an agent reads","url":"https://addaly.com/learn/how-software-changed/instructions-hidden-in-data"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'What leaves the building when you type', in How Software Development Changed. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/how-software-changed/what-leaves-the-building (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"What leaves the building when you type","courseTitle":"How Software Development Changed","module":{"index":8,"slug":"provenance-security-and-law","title":"Provenance, security and the unsettled law"},"answer":null,"keyIdea":"Retention and training are separate questions answered differently by consumer and business tiers, and since you cannot verify either claim, the only control you actually hold is minimising what goes into context in the first place.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"know-what-is-actually-sent","runs":[{"text":"Know what is actually sent"}]},{"t":"p","runs":[{"text":"A completion request is not just the line you are on. Depending on the tool it may include the surrounding file, other open tabs, files the tool judged related, a repository index, your recent edits, the last several terminal commands, and the diff you are about to commit."}]},{"t":"p","runs":[{"text":"The first useful action is to find out. Most tools document their context assembly somewhere unglamorous, and some will show you the request. If you cannot find out what is sent, assume the whole working tree, because that is the direction the products are moving."}]},{"t":"h2","id":"the-two-questions-that-matter","runs":[{"text":"The two questions that matter"}]},{"t":"p","runs":[{"text":"They are separate and people routinely conflate them."}]},{"t":"p","runs":[{"text":"Is it retained?","b":true},{"text":" How long does the provider keep the request, in logs or otherwise?"}]},{"t":"p","runs":[{"text":"Is it trained on?","b":true},{"text":" Does it enter a training set for a future model?"}]},{"t":"p","runs":[{"text":"The answers differ sharply by tier, and almost always in the same direction: consumer and free tiers are permissive, business and enterprise tiers are restrictive and contractual. Many free tiers train on input by default with an opt-out buried in settings; most paid business tiers commit not to, in the agreement rather than the marketing page."}]},{"t":"p","runs":[{"text":"Read the data processing addendum, not the landing page. The landing page says “your data is secure”, which is not a statement about retention or training. The addendum says how long, where, and to whom."}]},{"t":"h2","id":"the-concrete-leaks","runs":[{"text":"The concrete leaks"}]},{"t":"p","runs":[{"text":"These are the ones that actually happen, and none of them involve a sophisticated attacker."}]},{"t":"ul","items":[[{"text":".env","code":true},{"text":" open in a tab while completions run in the next file."}],[{"text":"A test fixture built from a production export, with real names, real addresses and a real card BIN."}],[{"text":"A connection string pasted into a chat to ask why it fails."}],[{"text":"A stack trace pasted whole, carrying a session token in a header dump."}],[{"text":"A migration script containing a customer identifier used as an example."}]]},{"t":"p","runs":[{"text":"The pattern is that the secret was not in the file you were thinking about."}]},{"t":"h2","id":"controls-that-work","runs":[{"text":"Controls that work"}]},{"t":"p","runs":[{"text":"Do not have real secrets in the repository at all.","b":true},{"text":" This is the only control that fully survives a mistake. Secrets live in a manager (your cloud’s own, or "},{"text":"sops","code":true},{"text":" with age, or Vault) and reach the process as environment variables at run time. "},{"text":"direnv","code":true},{"text":" with an untracked "},{"text":".envrc","code":true},{"text":" is a free version that works on a laptop."}]},{"t":"p","runs":[{"text":"Use the tool’s ignore file.","b":true},{"text":" Most assistants honour a per-tool exclusion list alongside "},{"text":".gitignore","code":true},{"text":": the name differs by product but the pattern is universal. Put "},{"text":".env*","code":true},{"text":", "},{"text":"*.pem","code":true},{"text":", "},{"text":"secrets/","code":true},{"text":", fixture directories and anything containing production data in it. Verify it works rather than assuming, by checking whether completions still reference an excluded file’s contents."}]},{"t":"p","runs":[{"text":"Scan before the commit, not after the push.","b":true},{"text":" "},{"text":"gitleaks","code":true},{"text":" and "},{"text":"trufflehog","code":true},{"text":" are free and run as a pre-commit hook in under a second on a normal diff."}]},{"t":"code","lang":"bash","label":"Bash","text":"gitleaks protect --staged --redact"},{"t":"p","runs":[{"text":"Generate the fixtures.","b":true},{"text":" Test data built by a factory (Faker or equivalent, free in every language) never contains a real person. Exporting from production “just for this test” is the most common route by which customer data ends up in a prompt."}]},{"t":"p","runs":[{"text":"Rotate what was exposed.","b":true},{"text":" If a live credential was in context, it is exposed. Not probably, not pending investigation. Rotate it and move on; the deliberation costs more than the rotation."}]},{"t":"h2","id":"the-regulatory-layer-briefly-and-without-advice","runs":[{"text":"The regulatory layer, briefly and without advice"}]},{"t":"p","runs":[{"text":"If a prompt contains personal data, sending it to a provider is a processing activity, and in most data-protection regimes that requires a lawful basis, a processor agreement, and a record. Code containing customer data is customer data: the fact that it is inside a Python file changes nothing."}]},{"t":"p","runs":[{"text":"Regimes differ in ways that matter operationally: where processing may occur, what must be disclosed, how long records are kept. This course is not the place to resolve any of that and cannot advise you. The operational point is narrower and holds everywhere: "},{"text":"you cannot verify a retention claim, so the only control you truly hold is what you send.","b":true},{"text":" Data minimisation is not a legal strategy, it is the one thing that does not depend on somebody else keeping a promise."}]},{"t":"h2","id":"your-own-logs-are-part-of-this","runs":[{"text":"Your own logs are part of this"}]},{"t":"p","runs":[{"text":"Teams that route requests through an internal gateway for cost control usually log the full prompt. That log is now a store of source code and whatever was in context, sitting in your observability stack with whatever retention that has, readable by whoever can read dashboards."}]},{"t":"p","runs":[{"text":"If you build a gateway, decide the retention deliberately, redact on the way in rather than on the way out, and put the log behind the same access controls as the source it contains. Most teams discover this log exists during an audit."}]}],"check":{"question":[{"text":"A team moves to an enterprise tier whose contract forbids training on their inputs. What risk does this leave untouched?"}],"options":[{"text":[{"text":"Nothing significant; a contractual no-training commitment is the control that matters for source code."}],"correct":false,"tempting":[{"text":"Treats one of the two questions as covering both, and ignores the team’s own infrastructure."}]},{"text":[{"text":"Generated code may still reproduce training data from other customers, creating a licensing exposure."}],"correct":false,"tempting":[{"text":"A real concern but unrelated to what this control was meant to address."}]},{"text":[{"text":"Retention is a separate question, and the team’s own gateway logs may store every prompt anyway."}],"correct":true,"tempting":null},{"text":[{"text":"Enterprise contracts typically exclude completions from their terms, covering only chat conversations."}],"correct":false,"tempting":[{"text":"Invents a contractual carve-out rather than identifying the structural gap."}]}],"order":[1,3,2,0],"why":null},"prev":{"slug":"vulnerabilities-that-arrive-by-default","title":"Insecure defaults, inherited","minutes":10},"next":{"slug":"instructions-hidden-in-data","title":"Instructions hidden in the things an agent reads","minutes":10}}}