Never paste secrets or proprietary code into prompts

A prompt is not a private scratchpad. Depending on the tool and the plan, what you paste can be logged, retained, or used to improve a service. Treat every prompt as something that might be stored outside your control, and decide what belongs there on that basis.

Never paste live secrets. API keys, tokens, passwords, connection strings, and certificates do not go into a prompt. Use a placeholder such as API_KEY_HERE and wire the real value in through your normal secrets mechanism afterward.

Be careful with proprietary or regulated code. Large blocks of internal source, customer data, or anything covered by contract or regulation may be off limits for a general consumer tool. Check whether your organization provides an approved assistant with business data terms, and prefer it for anything sensitive.

Redact before you ask. If you need help with a real snippet, strip identifiers and secrets first. The model can reason about the structure of a query or a handler without the real credentials or the real customer record.

Assume screenshots and error dumps carry secrets too. Stack traces and config files pasted for debugging often contain tokens, internal hostnames, and paths. Scan them before sharing.

The reasoning is simple. A leaked key is a live vulnerability the moment it leaves the building, and it cannot be unpasted. Building the habit of redacting first costs seconds and removes an entire class of accidental exposure.