Preventing secret leaks in AI chats

It's 3 AM. You're debugging an API issue and turn to ChatGPT for help. Without thinking, you paste your code — including the API key. You hit send. The key is now in someone else's system.

This scenario plays out thousands of times a day. Let's talk about why it happens and how to prevent it.

The accidental exposure problem

AI chat platforms have become indispensable for developers. They're faster than Stack Overflow, more interactive than documentation, and available 24/7. But this convenience comes with risks:

The clipboard is dangerous

Your clipboard contains everything you've recently copied:

• Code snippets
• API keys
• Database URLs
• Internal tokens

When you're in flow state, you don't always check what you're pasting.

Chat history persists

Most AI platforms keep conversation history. That means:

• Your secrets are stored on their servers
• They may be used for training (even if anonymized)
• They're accessible if your account is compromised

Screenshots get shared

Developers love sharing interesting AI interactions. A quick screenshot of a helpful response might accidentally include a visible API key.

Real-world examples

Here are patterns we've seen in the wild:

// "Help me debug this fetch call"
fetch('/api/data', {
  headers: {
    'Authorization': 'Bearer sk_live_...'  // Oops
  }
});

# "Why is this connection failing?"
conn = psycopg2.connect(
    host="db.company.com",
    password="SuperSecret123!"  # Oops
)

# "What's wrong with this curl command?"
curl -H "X-API-Key: ghp_..." ...  # Oops

Prevention strategies

1. Use environment variables

Never hardcode secrets. Always use environment variables:

// Good
fetch('/api/data', {
  headers: {
    'Authorization': `Bearer ${process.env.API_KEY}`
  }
});

2. Use a secrets manager

For team environments, use dedicated tools:

• 1Password
• HashiCorp Vault
• AWS Secrets Manager
• Doppler

3. Rotate compromised keys immediately

If you suspect a leak:

1. Generate a new key
2. Update your applications
3. Revoke the old key
4. Check access logs for unauthorized usage

4. Use SecretPaste (shameless plug)

SecretPaste catches accidental pastes before they become problems. It:

• Detects common secret patterns
• Shows a warning modal before pasting
• Lets you choose to cancel, allow, mask, or paste anyway

What to do if you leak a secret

1. Don't panic — act quickly but methodically
2. Revoke the key — this is your first priority
3. Check logs — look for unauthorized access
4. Rotate related keys — if one is compromised, others might be
5. Notify your team — transparency helps everyone respond

The future of secret protection

We believe secret protection should be:

• Invisible — works without you thinking about it
• Local — your data never leaves your device
• Proactive — catches leaks before they happen
• Respectful — doesn't disrupt your workflow

SecretPaste is our attempt at this vision. We're constantly improving detection patterns and adding support for more platforms.

Best practices checklist

• Use environment variables for all secrets
• Enable 2FA on all accounts with API access
• Regularly rotate API keys (quarterly is good)
• Use different keys for different environments
• Monitor access logs for anomalies
• Install SecretPaste (or similar protection)
• Educate your team about secret safety

SecretPaste is a free Chrome extension that helps prevent accidental secret leaks. Get it here.