Secrets, and what not to paste

The short list

Some things should never go into a chat box with any provider, on any tier, under any terms, because the cost of being wrong is out of proportion to the convenience.

• Passwords and passphrases. Yours or anyone else’s.
• API keys, tokens and connection strings. Including the ones sitting in a config file you paste to ask why the file is not working.
• Private keys and certificates.
• Full payment card numbers, bank details, government identity numbers.
• Anything covered by a specific legal duty you cannot discharge: sealed material, some categories of health and criminal record data, anything under a court order.
• Whole databases of other people’s personal information.

The reason is not that a provider is likely to misuse them. It is that this material multiplies: it lands in conversation history, in backups, in an abuse-monitoring store, in a screenshot somebody takes, in an export you share with a colleague. Every copy is another chance, and none of them was necessary, because the model did not need the secret to answer the question.

The paste that catches developers

Debugging a configuration file or an error log is one of the best uses of these tools, and it is the most common way keys leak.

# what people paste
DATABASE_URL=postgres://admin:hunter2@db.internal:5432/customers
STRIPE_KEY=sk_live_51H...
Traceback: connection refused

# what the model needs
DATABASE_URL=postgres://USER:PASS@HOST:5432/DBNAME
Traceback: connection refused

The second version gets exactly the same answer. Make the substitution automatic: when you copy a config file or a log, replace the values before you leave the clipboard. It takes five seconds and it is the difference between a helpful conversation and a leaked credential.

Screenshots of a terminal are the same problem with none of the opportunity to edit. Terminal windows show environment variables, hostnames, usernames and paths that identify your employer. Crop, or paste text you have cleaned.

Code, and what it reveals

Source code carries more than logic: internal hostnames, table structures, business rules, customer names in test fixtures, and comments people wrote when they were annoyed. Before pasting a file from work, look at it as a document rather than as code.

If your employer has a policy, it governs. If your employer has no policy and you are pasting proprietary code into a consumer service, you are making a decision on their behalf that they may not have made.

After an accidental paste

It happens to careful people. The response, in order:

1. Rotate the secret immediately. A key, a password, a token: revoke and reissue. This is the only step that fixes anything, and it takes a minute.
2. Delete the conversation. Worth doing. It limits further exposure and it does not undo storage that has already happened.
3. Check the retention terms. You now know how long the copy persists.
4. If it was somebody else’s data, tell whoever is responsible. Many organisations have a reporting duty with a clock on it, and the clock started when it happened rather than when you mentioned it.
5. Write down what happened. One paragraph. If it is ever asked about, the contemporaneous note is what makes it a handled incident rather than a concealed one.

Nobody has ever been in less trouble for reporting this quickly. The instinct to hope it does not matter is understandable and it is exactly backwards: the small immediate action is cheap, and the delay is what turns it into a serious matter.

Scanning before you share

If you regularly paste code or configuration, install a scanner once. gitleaks and trufflehog are free, run in a second, and detect the common key formats. Running one over a file before you copy it is a five-second habit that catches the credential you had forgotten was in there.

The same tools run as a pre-commit hook on a repository, which catches the other version of this mistake. Neither is specific to AI tools; both belong to any working life where secrets and text move around, and this is one more reason to have them.

The habit that prevents most of it

Keep secrets out of the things you paste from, rather than remembering to remove them at the moment of pasting. Environment variables instead of literals in config files, placeholder values in examples, and no credentials in test fixtures. Then the careless paste, when it eventually happens, contains nothing worth having.