Secrets never go in prompts

A prompt is data that leaves your machine and may be logged, retained, or used to improve a model, depending on the tool and its terms. So the rule is simple and absolute: real secrets never go into a prompt. Not API keys, not connection strings, not tokens, not customer records, not the contents of a .env file.

This matters more in DevOps than almost anywhere, because our config is full of credentials and it is tempting to paste a whole file to get help. Do not. Redact first, then ask.

How to get help without leaking:

• Replace real values with named placeholders: DATABASE_URL, API_TOKEN, ACCOUNT_ID. The model can reason about structure without the secret.
• Share the shape of an error, not a raw log that contains tokens or internal hostnames.
• Prefer a company-approved, contractually covered AI over a personal account; the data terms are very different.
• Wire real values through your secret manager or CI secrets, and let AI generate the code that references them by name.

Ask for the safe pattern directly:

Show how to read this token from GitHub Actions secrets and pass it to the deploy step, without ever printing it to the log.

Remember the flip side too: models will happily write config that echoes secrets into logs. When you review generated pipelines, check that nothing prints a credential and that verbose debug logging, which can expose inputs, is turned off.