Never paste credentials, state files, or secrets

Some data must never go into an AI prompt, and in cloud work the temptations are everywhere. The rule is simple: if leaking it would create an incident, it does not belong in a chat window.

The obvious offenders:

• Credentials and keys. Access keys, secret keys, service-account JSON, API tokens, connection strings, and passwords. Pasting one to get help debugging is how a key ends up somewhere you cannot control.
• State files. A Terraform or OpenTofu state file is a goldmine. It can contain resource IDs, IP addresses, and, worse, secret values captured as attributes. Never paste raw state to ask what changed.
• Real identifiers. Account numbers, private IP ranges, internal hostnames, and customer data map out your environment for anyone who later sees the prompt.

Safe substitutes keep AI useful without the risk:

• Redact and use placeholders. Replace real values with tokens such as ACCOUNT_ID, VPC_ID, and DB_PASSWORD. The model reasons about the structure just as well.
• Wire real values in yourself. Let AI write config that references a variable or a secrets manager, then supply the actual value in your own environment.
• Prefer an approved, private assistant. If your organization provides an enterprise AI tool with contractual data terms, use it. A personal account has very different terms for what happens to your input.

None of this slows you down once it is a habit. You lose nothing by sending PROJECT_ID instead of the real one, and you avoid the one mistake that turns a helpful session into a security review.