Keep secrets out of your files and chats

Once you start connecting AI to your tools, you collect secrets: API keys, access tokens, webhook links, passwords. Each one is a key to part of your business. I've made most of the mistakes you can make with them, including one command that wiped about thirty of them off my computer in a second, with no copy anywhere.

This guide is what I do now. It's practical advice from running a small studio, not professional security advice. If you handle sensitive client data, have your setup checked by someone qualified.

What counts as a secret

A secret is anything that lets a program act as you. The common ones:

• Passwords for your accounts.
• API keys, long strings of letters and numbers that let software use a service and often bill you for it (the previous guide explains these).
• Tokens, similar to keys, that give a tool access to an account.
• Webhook links, special web addresses that let anyone who has them post messages into a channel or trigger an action.

If someone could do damage or spend money with it, treat it as a secret.

Step 1: Give every secret one proper home

Secrets should live in two places, and only these:

• Your password manager (see "Lock down your accounts before you connect AI"). This is the master copy of every secret you have.
• The settings file or settings screen of the tool that uses it. On your own computer this is often a small file named something like .env. On a hosting service, it's that service's settings page.

Never put a secret in a document, a note, a wiki page, a spreadsheet or a shared folder. Those get copied, synced and shared in ways you won't track.

Step 2: Never paste a secret into an AI chat

This is the one I most want you to take away. Your AI chats are saved. Claude Code keeps a record of each conversation as a file on your computer, and other tools keep histories too. A key pasted into a chat sits in that file long after the job is done.

It happened to me. I pasted a key into a chat knowing the risk, because it was a free key with nothing to lose. It ended up in the saved conversation and also in the automatic name the system gave that file. I had to go back and remove it from both.

If the AI needs a key, use this pattern instead:

1. Create a small text file and paste the key into it yourself.
2. Tell the AI the file's location and ask it to read the key from there and put it where it belongs.
3. Empty or delete the text file afterwards.

The key never appears in the conversation.

Step 3: Treat anything that leaked as burned

If a secret has been somewhere it shouldn't (a chat, an email, a screenshot, a file you sent someone), cancel it and make a new one. Do this even if it still works. You can't know who else saw it, and the fact that it still works is the problem.

Then check that the new one is in use everywhere. Replacing a key isn't finished until every tool that used the old one has the new one. I once replaced a key, then found an older copy still running live somewhere I hadn't looked.

Step 4: Back up your settings file before running commands

Here's the command that wiped mine. A setup tool can download your settings from your hosting service into a file. An AI session ran that command intending to save the result to a temporary file. A small mistake left the destination blank, so the tool used its default, which was my main secrets file. It overwrote around thirty real secrets with empty values.

Some of them could be rebuilt from other places. Several couldn't. Many services only show you a key once, when you create it, and won't display it again. Some hosting services also store secrets so they can't be read back by anyone. The only fix for those was to create new ones, one service at a time.

What I do now:

• Copy the settings file somewhere safe before any command that could write to it. It takes a second.
• Keep every secret in your password manager as well. If a secret only exists in one file on one computer, it's one mistake away from gone.
• Ask the AI what a command will change before it runs one that touches settings. If it can't say clearly, don't approve it.

Step 5: Check the whole value, including spaces

This one cost me months of missing data. My website analytics recorded nothing, and every check said the settings were fine. The cause was a single space at the end of a key I'd pasted. My check looked for the key, found it, and stopped reading before the space.

When you paste a secret anywhere, check there's nothing before or after it: no space, no line break, no quote mark. And test the result by watching whether the thing actually works. Here, that meant seeing a visit show up in the analytics, rather than trusting that the setting looked correct.

Step 6: Keep secrets out of anything you share

If you back up your work to a service that keeps history, such as GitHub (a site for storing and sharing code), a secret saved there once stays in the history even after you delete the file. Make sure your settings files are excluded before you ever back up a folder. Ask your AI to check this for you, then look at the list yourself.

What to do next

Tonight, search your documents and notes for anything that looks like a key or password and move it into your password manager. Then make a backup copy of any settings file your tools use.

That's the end of this track. Your workspace is set up, organised, and much harder to break. If you'd like someone to check where your secrets live now and what would happen if one leaked, ask me for the free audit. I'll show you the riskiest ones to fix first.