.png){kind=small}
Secrets, Keys, and Tokens: Never Paste These
Why secrets in prompts are dangerous, redaction patterns, what GitHub does with prompt content.
What You Will Learn
- Recognize what counts as a secret.
- Redact secrets before pasting.
- Understand plan-level data handling.
- Build a pre-paste review habit.
- Set up guardrails (pre-commit hooks).
Why This Matters
A pasted API key in a Copilot prompt leaves your machine. Even on plans that don't train on your data, the prompt content is transmitted to GitHub's service. One paste can mean a leaked secret. This lesson builds the reflex that prevents it.
Concept Explained
Secrets include: API keys, OAuth tokens, passwords, SSH private keys, certificates, internal URLs with auth, customer data, PII. Copilot prompts are sent to GitHub's model service; secrets in prompts are exposed.
How It Works
Before pasting anything into Chat or a prompt, scan for secrets. Replace with placeholders like `YOUR_API_KEY`. Use environment variables in code, never hardcoded strings. Pre-commit hooks can catch secrets before they reach git (or Copilot).
Step-by-Step Tutorial
1. Identify secrets
API keys (sk_*, AKIA*), tokens (ghp_*, Bearer *), passwords, SSH keys, certs, customer data, internal URLs with auth.2. Redact before pasting
Replace with placeholders: `YOUR_API_KEY`, `YOUR_TOKEN`. Or omit entirely.3. Use env vars in code
`const apiKey = process.env.API_KEY;` Never hardcode.4. Set up pre-commit hooks
Use tools like git-secrets, gitleaks, or GitGuardian to scan before commit.5. Verify plan-level handling
Business/Enterprise: prompts not used for training. Free/Pro: opt-out required. See BE-34.Real-World Example
A developer pasted a stack trace that included an environment variable dump. The dump contained a Stripe API key. The key was transmitted to Copilot's service. They rotated the key within 5 minutes, but the exposure was real. A pre-paste scan would have caught it. A pre-commit hook would have caught it earlier.
Example Prompts / Commands / Code
API keys:
- Stripe: sk_live_*, sk_test_*
- AWS: AKIA*
- GitHub: ghp_*, gho_*, ghs_*
- OpenAI: sk-*
- Slack: xox*
- Generic: Bearer *, Authorization: *
Other:
- JWT tokens (eyJ*)
- SSH private keys (-----BEGIN ...)
- Database connection strings with passwords
- Internal URLs with embedded auth (https://user:pass@internal.corp)
- Customer PII (emails, phone numbers if not your own)
Before pasting into Chat:
1. Scan for keys, tokens, passwords.
2. Scan for internal URLs with auth.
3. Scan for customer PII.
4. Replace secrets with placeholders.
5. If unsure, don't paste — describe the structure instead.
Common Mistakes
- Pasting full environment dumps without scanning.
- Hardcoding secrets in code 'just for testing'.
- Assuming Free/Pro doesn't use data — it does unless you opt out.
- Pasting internal URLs with embedded auth.
Best Practices
- Always scan before pasting — make it reflexive.
- Use placeholders: YOUR_API_KEY, YOUR_TOKEN.
- Hardcode never; use env vars always.
- Install pre-commit secret scanners (gitleaks, GitGuardian).
- Verify your plan's data handling (Business/Enterprise = no training).
Troubleshooting
| Problem | How to Fix |
|---|---|
| Pasted a secret by accident | Rotate immediately. Update all consumers. Audit logs for misuse. |
| Not sure if something is a secret | Treat it as one. Better safe than leaked. |
Practical Exercise
Your Turn
Pick a recent Copilot prompt you used. Scan it for secrets using the checklist above. Identify any near-misses. Set up gitleaks as a pre-commit hook in one of your repos.
Key Takeaways
- Secrets in prompts are transmitted to Copilot's service.
- Always scan before pasting; replace with placeholders.
- Hardcode never; env vars always.
- Pre-commit hooks catch secrets before they reach git.
- Verify plan-level data handling (BE-34).
Frequently Asked Questions
Does Copilot store my prompts?
What if I already pasted a secret?
Further Reading
Official References
Related lessons: BE-31, BE-34, PR-40
SEO Metadata
SEO title: Secrets, Keys, and Tokens: Never Paste These
Meta description: Why secrets in prompts are dangerous, redaction patterns, what GitHub does with prompt content.
Primary keyword: secrets, keys, and tokens
Secondary keywords: secrets, keys, and tokens: never paste these
Search intent: Informational
URL slug: /copilot-secrets-keys-tokens-never-paste
Categories: AI Tools, GitHub Copilot
Tags: GitHub Copilot, Beginner, Security, Secrets, Privacy, IMCSEIAN, Tutorial, IMCSEIAN
Featured image concept: IMCSEIAN lesson card for Secrets, Keys, and Tokens: Never Paste These
Comments
Comments
Post a Comment