The most common way a secret leaks is a paste.
HOLD POINT · THE PASTE · CHAT PROMPTS · FIELD REPORT
General notes
- 01Nobody uploads a production key on purpose. They paste an error log into a chat to ask why it failed. The key is in the log.
- 02Vendor keys have prefixes a scanner can catch. The hard case is plain: "my api key is …" typed in a sentence, too short to look random.
- 03Anchor on the label, validate the value, and leave "password is required" alone. That is prose, not a secret.
the key was in the log.
Schedule of secret shapesHow each is caught
| Shape | Example | Caught by |
|---|---|---|
| Vendor prefix | sk-… · AKIA… · ghp_… | Prefix and length |
| Labelled value | "my api key is …" · "my password is …" | Label anchor + value validator |
| Prose | "api key management" · "password is required" | Left alone (denylist) |
As posted
Nobody uploads a production key on purpose.
What happens is this. Something breaks at eleven at night. You copy the error log, paste it into a chat window and ask why it failed. The key was in the log. It has now left your machine, and it lives in someone else's retention policy.
Vendor keys are the easy part. They have prefixes and lengths a scanner can catch: the OpenAI shape, the AWS shape, the GitHub shape. The hard part is plain English. "My API key is …" typed in a sentence, with a value too short to look random. "My password is …" followed by a real password. No prefix. No entropy to speak of.
A field report on exactly that prompt closed the gap in the engine I ship. The fix has two halves. Anchor on the label: the words "api key is" and "password is" are the signal. Then validate the value: a key needs letters and digits, a password needs a separator and must not be a common word, or half of normal prose would light up. And leave "password is required" alone. That is documentation, not a secret.
The second half matters as much as the first. A scanner that flags "api key management" gets switched off within a week, and then it catches nothing.
Hold point. Before you paste, look at what is in the clipboard. Or have something look for you.
Sheet 018.