Never paste secrets or production data

Test code sits close to real systems, so the safety rule here is blunt: what you paste into an AI tool can leave your control, so never paste anything you would not publish.

The items that must stay out of a prompt:

• Secrets. API keys, tokens, passwords, connection strings, certificates.
• Production data. Real customer records, personal information, health or financial data.
• Internal identifiers. Anything that maps back to a real account, system, or person.

The safe substitutes are easy. Use obvious placeholders such as API_KEY or [CUSTOMER_EMAIL], and wire the real values in through environment variables or a secrets manager, never in the prompt or the committed test. For test data, ask AI to generate synthetic records that match the shape of the real thing without being the real thing.

Two more habits worth keeping. Prefer an approved, contractually covered AI tool over a personal account, because the data terms differ sharply. And when a generated test hard-codes something that looks like a real credential, treat it as a finding, not a convenience.

Synthetic data has a bonus: it often produces better tests, because you control the edge cases instead of hoping production happened to contain them.