Never paste API keys, passwords, access tokens, private keys or real customer data into an AI assistant. Once data leaves your systems you may not control how it is stored or used, and a leaked key can be abused within minutes. Use placeholders, test data and environment variables instead.
What counts as a secret
- API keys and tokens for payment, email, database and cloud services.
- Passwords and private keys.
- Connection strings and
.envfiles. - Customer personal data: names, phone numbers, emails, addresses, documents.
- Internal documents and unreleased business information.
How leaks happen
- Pasting a
.envfile to ask why something is not working. - Sharing logs that contain tokens or personal data.
- Giving an AI agent access to a whole folder that includes secrets.
- Committing generated code that has a key written into it.
- Using a tool without checking how it handles and stores your data.
Safer habits
| Instead of | Do this |
|---|---|
| Pasting a real key | Use a placeholder like YOUR_API_KEY |
| Sharing a real customer record | Use made-up test data |
Sharing a full .env | Share only the variable names |
| Pasting full logs | Remove tokens and personal data first |
| Letting an agent read everything | Limit it to the project folder and exclude secret files |
Protect your repository
- Keep secrets in environment variables or a secrets manager, never in code.
- Add secret files to
.gitignore. - Run a secret scanner before commits.
- Rotate any key that may have leaked, immediately.
- Give each service the minimum permissions its key needs.
Check your tools
Before you adopt an AI tool, check what it does with your code and prompts, whether it uses them for training, how long it keeps them and whether you can turn that off. Business plans often have different terms from free ones.
If you already pasted a secret
Assume it is compromised. Revoke and replace it, check usage logs for unusual activity and update your process.
We follow these habits ourselves: secrets and customer data stay out of prompts, and AI tools never get production access. See how we use Claude for coding and AI coding do's and don'ts.