Redact Before You Paste It Into the Coding Agent
Mid-debugging, I pasted a raw terminal block into the agent: a curl response with the Bearer token on the first line, an internal hostname, and three rows of customer email addresses. The answer was good. The next morning I realized the paste is still somewhere.
The prompt is not a scratchpad
Chat history can be retained by the model provider, synced across an editor's cloud, exported for review, or opened by a teammate in a shared session. What you type is not temporary; it enters a log you do not fully control. A secret you paste once rarely gets rotated just because the fix shipped. The agent forgets the token. The transcript does not.
What actually leaks
| Item | Why it matters | Safer to send |
|---|---|---|
| Bearer token / API key | Stays valid after the fix and can be replayed | <TOKEN> placeholder, then rotate |
| Internal hostname / IP | Reveals infrastructure topology | service.internal |
| Customer email, phone | Privacy and compliance exposure | user@example.com, report counts only |
Full .env block | Exposes every credential at once | One non-secret config line |
| Stack trace with session ID | Correlates to a live session | Scrub the ID, keep the frames |
The model almost never needs the real value to reason about the bug. It needs the shape: which header, which field, which status code, which error type. Give it the shape and it reaches the same conclusion.
Scrub before you send
Replace the value, never the key name. Authorization: Bearer <REDACTED> keeps the structure the agent uses to reason, without handing over a live credential.
Give a shape instead of a payload. Field names, the status code, and the error type beat the full response body, which is exactly where secrets and PII hide.
Keep live calls on your machine. For API debugging I run the request locally and inspect the authenticated response myself; the agent gets a scrubbed status line plus the expected field shape, not the token. A local-first studio such as Powerduck keeps that authenticated request on your machine, so it never has to leave your device or land in a shared prompt.
Rotate anything that already slipped. Swapping in a placeholder after the fact does not undo the paste that already happened.
A prompt that still helps
Open with the route, the status code, the error type, and the input shape. Ask what condition produces that response. Leave the token, the host, and the customer rows out. You get the same diagnosis with no exposure, and the transcript stays something you would be comfortable showing in a code review.
What is the most sensitive thing you have ever caught yourself about to paste into a coding agent?