The pasted config file
A developer is stuck on a payment error late at night. She pastes the whole config file into a public AI chat, and the fix arrives at once.
The next morning the security team calls. The file held the live payment key. It has to be replaced today, and every system that uses it has to change.
By the end of this lesson
Note
I can keep secrets and personal data out of a prompt.
Key words
| Word | What it means | Example |
|---|---|---|
| Secret | a value that gives access, such as a password | |
| API key | a secret that lets a program use a service | sk-EXAMPLE-123 |
| Personal data | facts about a person who can be identified | |
| Placeholder | a stand-in for a real value | [EMAIL] |
| Redact | to remove or hide sensitive parts | |
| Rotate | to replace a secret with a new one |
The cells students fill in are left blank in this preview.
What you paste leaves your laptop
A prompt is sent to the company that runs the model. It may be stored, logged or read by its staff, depending on the tool and its settings.
So your employer decides which assistants are approved, and for what. Never paste secrets or personal data into a tool that is not approved for them. Data protection law applies to customers' details wherever you put them.
Safe to paste?
| What | Safe to paste? | Why |
|---|---|---|
| A function with made-up test data | Yes, in an approved tool | Nothing real is in it |
| An error message with no customer details | Yes, in an approved tool | It helps the fix |
| A config file with passwords | No | It holds secrets |
| A real customer list | No | It is personal data |
| A payslip or HR record | No | It is personal data |
The cells students fill in are left blank in this preview.
Swap real values for placeholders
You can usually get the same help without the real details. Replace each sensitive value with a placeholder before you paste.
The assistant only needs the shape of the data. "[EMAIL]" works as well as a real address. For secrets, never paste the value at all. Write "the key is read from an environment variable".
Try it: clean a ticket
# A real support ticket, before it goes near an assistant.
ticket = "Priya Shah ([email protected]) says order 5512 shows the wrong total."
# Swap the real details for placeholders.
safe = ticket.replace("Priya Shah", "[NAME]")
safe = safe.replace("[email protected]", "[EMAIL]")
print(safe)
# The assistant does not need the order number either.
# Add a line that swaps "5512" for "[ORDER]", then press Run.
If a secret slips out, report it
Mistakes happen. If you paste a secret, tell your manager or the security team straight away.
The secret must be rotated: replaced with a new one, and the old one switched off. Then nobody who saw the old one can use it. Reporting fast makes the fix small.
A common mistake
Warning
Many people think deleting the chat removes the secret. Once it was sent, it may already be stored or logged. So a pasted secret is always reported and rotated, even if the chat is gone.