Keep secrets out of AI prompts and AI-written code
Prompts and chat logs may be stored. Treat them as not private unless your plan says otherwise.
What to do
- Never paste keys, passwords, tokens or customer personal data.
- Use environment variables or a secrets manager; add .env to .gitignore.
- Turn on secret scanning in your Git host.
- If a key leaks, rotate it immediately; deleting the commit is not enough.
Copy this prompt
Review this code for hardcoded secrets, injection, unsafe deserialization, path traversal and missing auth checks. Report severity and fixes. Code:
[paste with secrets removed]Check the bot's work
Use a real scanner as well as the bot.
Questions
Can I trust the bot on secrets and security?
Use it to plan and explain, then verify. Use a real scanner as well as the bot.
Which bot works best?
Grok Bot, ChatGPT, Claude and Gemini all handle this prompt. Paste the same prompt into two and compare; disagreements show where to check a source.
Where these facts come from
- OWASP Top 10
- CISA: Secure by Design
- GitHub Docs: Secret scanning
- W3C: WCAG overview
- Open Source Initiative: Licenses
- NIST SP 800-218: Secure Software Development Framework
Tools, features and prices change often. We don't list prices; check each vendor's official pricing page. Never paste secrets into a prompt. Checked Oct 30, 2026.
Coding with bots · Quality, security and careers: all lessons → Next: OWASP-style review →