The rule

Never paste a password, key or token into a prompt.

Everything you type goes to a company’s servers. It may be stored. It may be logged.
Treat anything you send as no longer private.

What counts

  • API keys
  • Database passwords and connection strings with a password inside
  • Session tokens and cookies
  • Private keys and certificates
  • Real customer data — names, phone numbers, addresses, payment details

That last one gets forgotten. Pasting a real database row to debug something means pasting a
real person’s details.

How to work without them

Use fake values. The agent does not need your real key to write code that uses a key.

Bad:   Here is my key, sk-abc123..., make the request work.
Good:  The key is in process.env.API_KEY. Write the request assuming
       it is set. Never print the key.

Keep secrets in a file git ignores

# .env  — never committed
DATABASE_PATH=/data/recall.db
SESSION_SECRET=some-long-random-value

# .gitignore
.env
recall.db

Commit a .env.example with the names and no values, so anyone (including an agent) can see
what settings exist without seeing them.

Before you point an agent at a folder

From Lesson 3.3, and worth repeating now that you are handling real settings: check what is
in the folder first.

git status --ignored | head -30

An agent reading your project can read .env if it is there. It usually has no reason to,
but “usually” is not a safety measure.

If you have already pasted a secret

It happens. Do this, in order:

  1. Change the key. Generate a new one and delete the old one at the source. This is the
    only step that actually fixes anything.
  2. Remove it from your code and history if it was committed.
  3. If it was a shared or work key, tell whoever owns it.

Do not skip step 1 and hope. A key that has been sent somewhere is no longer yours.

Try this before the next lesson

  1. Search your project for anything that looks like a key. Are any committed?
  2. Check that .env is in .gitignore. Create .env.example.
  3. Look back at your sessions from this course. Did you paste anything you should not have?
PreviousNext