Your secrets don't need a git commit to leak into an AI tool

Most of us have the "don't commit secrets" reflex drilled in. Pre-commit hooks, secret scanners in CI,.env in.gitignore. Good. That covers the repo.

When you work with an AI coding assistant, what leaves your machine isn't just the file you're editing. It's whatever you paste, whatever the extension decides is relevant, and whatever the agent reads while it's "helping." The security boundary now includes the editor extension, the chat history, any telemetry, and every service that processes that context on the way to the model and back.

Secret scanners watch commits. Nothing in a typical setup watches what you paste into a chat panel at 6pm while a deploy is failing.

Here are the usual ways a secret ends up in context without ever touching git.

An integration test fails. The assertion message helpfully dumps the client object, which includes the connection string with the password inline. You copy the whole test output into the assistant and ask "why is this failing?"

The question was about the assertion. The payload included the credential.

$ env | sort... AWS_SECRET_ACCESS_KEY =... DATABASE_URL = postgres://app:...@db.internal:5432/prod STRIPE_SECRET_KEY = sk_live_... Enter fullscreen mode Exit fullscreen mode "Here's my environment, why can't the app find the config?" is a completely normal debugging move. It's also the fastest way to hand over every key on the box in one paste. Agents that can run shell commands can do this on their own if you let them.

A verbose HTTP client logs request headers. One of them is Authorization: Bearer.... You paste 200 lines of log to get help with a timeout, and line 143 is a live token.

Someone shares a "working example" in Slack with the key still in it. You paste it into the assistant to adapt it. Now it's in two systems you don't control instead of one.

(These are illustrative scenarios, not specific incidents, but if you've debugged anything under pressure you've probably seen at least one.)

Deleting the chat message is not remediation. You don't know what was logged, cached or forwarded before you hit delete. Treat it like any other exposure: rotate the credential, revoke the old one, check access logs for use.

Secret management used to be a version control problem. With AI tools in the loop, it's a data-flow problem: anything that reaches the model's context has, to some degree, left your control.

The safest secret is the one that never enters the context in the first place.

How does your team handle this today? Do you have any tooling that checks what goes into an AI assistant, or is it all down to developer habit?