Data safety: what never goes in a prompt

Debugging is where sensitive data leaks into AI tools most easily, because the fastest thing to do under pressure is paste the whole log. That log may carry access tokens, API keys, connection strings, session cookies, customer emails, and personal records. Once pasted, that data can land in vendor logs, human review queues, and places you cannot pull it back from.

The habits that keep you safe:

Redact before you paste. Replace secrets and personal data with placeholders like [API_KEY], [EMAIL], [CUSTOMER_ID]. Keep the structure so the model can still reason; remove the value so nothing real leaves your perimeter.

Prefer the approved tool. If your employer offers a private or enterprise assistant covered by a data agreement, use it instead of a personal account. The terms on what happens to your input are very different.

Never paste production secrets or real customer records. A stack trace almost never needs the actual key or the actual name to be understood. Send the shape, not the secret.

A leak during debugging is not hypothetical: surveys through 2026 found a large share of employees pasting sensitive data into unapproved AI tools, and the regulatory cost of a customer data leak dwarfs any time the paste saved. The one-second habit of redacting is far cheaper than the incident.