Secrets, Private Code and Licences

The problem

A developer pastes a failing config file into an AI chat to ask for help. It contains the production database password. Another developer copies a large function an assistant produced, which closely matches code from a project under a licence your company does not allow.

Real-world analogy

You would not read your bank PIN aloud to a helpful stranger, even if they are fixing your card reader. Share the problem, not the secret.

The idea

• Know the rules: your company's policy on which AI tools are approved and what code or data may be shared with them, and the tool's data settings (retention, training use).
• Never paste secrets: keys, passwords, tokens, customer data. Replace them with placeholders before sharing.
• Scan before sharing and before committing: secret scanners catch keys in files and diffs.
• Licences: be careful with long, distinctive generated code; some tools offer filters that block suggestions matching public code. When in doubt, check and attribute.
• Rotate immediately if a secret was exposed; deleting the message is not enough.

The code

A small pre-share scanner that replaces likely secrets with placeholders:

import re

RULES = [
    (r"(?i)(password|passwd|secret|token)\s*[:=]\s*\S+", r"\1=<REDACTED>"),
    (r"postgres(?:ql)?://([^:\s]+):[^@\s]+@", r"postgresql://\1:<REDACTED>@"),
    (r"\bAKIA[0-9A-Z]{16}\b", "<AWS_ACCESS_KEY_ID>"),
]

def mask(text):
    count = 0
    for pattern, replacement in RULES:
        text, n = re.subn(pattern, replacement, text)
        count += n
    return text, count

config = ("DATABASE_URL=postgresql://app:[email protected]:5432/shop\n"
          "AWS_KEY=AKIAIOSFODNN7EXAMPLE\n"
          "DEBUG=false\n"
          "api_token: tok_9f8e7d6c5b4a")
masked, found = mask(config)
print(masked)
print("secrets masked:", found)

DATABASE_URL=postgresql://app:<REDACTED>@db.internal:5432/shop
AWS_KEY=<AWS_ACCESS_KEY_ID>
DEBUG=false
api_token=<REDACTED>
secrets masked: 3

Common mistakes

• Pasting full config files or logs that include credentials or customer data.
• Assuming a deleted chat message removes the exposure.
• Using unapproved AI tools with company code.
• Copying long generated code without considering licences.

Key points

• Follow your company's AI tool policy and know each tool's data settings.
• Never share secrets or customer data; mask before sharing and scan before committing.
• Rotate exposed secrets immediately, and be careful with licences.

Further reading: OWASP secrets management cheat sheet · Gitleaks secret scanner · Choose a license: licence overview