Security hygiene

Redact secrets before you paste into AI

By Justin Helmer · 8 August 2026 · Not a substitute for professional security advice

Every week, someone pastes an .env into a chat. This guide is the boring discipline that prevents that story from being yours.

What counts as a secret

• API keys, tokens, session cookies
• Private keys and keystore files
• Passwords and connection strings
• Personal data you would not post on a public issue tracker

Workflow

1. Copy text to a scratch buffer, not straight into the model.
2. Search for sk-, ghp_, Bearer , BEGIN PRIVATE, password=.
3. Replace with placeholders like [REDACTED_OPENAI_KEY].
4. If using agents that pack logs, run a redaction step (for example context-guard style tools) before model inject.
5. Rotate any key that might have been exposed — do not debate; rotate.

Agent-specific rules

Never ask an agent to “read all env files and fix deploy” without a allowlist. Prefer examples with fake credentials. Continuum claims should hash files, not embed secret needles.