Back to Gallery
Campaign Day 11#SpotTheLeak

SpotTheLeak Day 1

"Never paste Live API Keys into any AI Prompts."

Vulnerability Focus

Scrub off any secrets or credentials before you paste them to AI prompts.

In this #SpotTheLeak episode we look at one of the fastest ways to compromise a system: pasting a live API key into an AI prompt. It feels harmless — you just want help debugging — but that key can be logged the instant you hit send.

Why a leaked key is a worst case

An API key is a password with no face. Whoever holds it can act as you: drain quotas, read data, or run up charges. If it lands in a prompt history or a training set, you may never know it escaped.

Handle credentials the right way

  • Keep keys in environment variables or a secrets manager, never in chat.
  • Rotate any key immediately if it's ever been pasted where it shouldn't be.
  • Let a redaction layer block credential patterns before they leave.

Scrub secrets before you prompt — every time. A DLP engine recognizes keys and tokens on sight and stops them at the door.

Share this insight