Asking AI to debug your config without handing over the keys
The most common reason a developer pastes something risky is the most legitimate one: something is broken and the error message is surrounded by configuration.
Here is a realistic example, worked through end to end.
The message you were about to send
Hi team,
Deploy failed again on staging. Full trace attached below.
Reach me at [email protected] or +1 415-555-2671 if it is urgent.
DB_HOST=db01.internal
DB_PASSWORD="Tr0ub4dor&3"
STRIPE_KEY=sk_live_4eC39HqLyjWDarjtT1zdp7dc
export GITHUB_TOKEN=ghp_16C7e42F292c6912E7710c838347Ae178B4a
curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…" \
https://api.internal.acme-corp.com/v2/deploy
Order #113-7782991-4406620 is blocked by this.
Thanks!Fifteen lines. Nothing unusual about it, and that is the point: this is what a real question looks like.
What the scan finds
Eight findings, across five categories:
| Category | Count | What |
|---|---|---|
| API key / token | 3 | Stripe live key, GitHub token, Bearer JWT |
| Internal host | 2 | db01.internal, the API hostname |
| 1 | the sender's address | |
| Phone | 1 | the sender's number |
| Password assignment | 1 | the database password |
The Stripe key is the one that should make you pause. sk_live_ is a live secret key, not a test key, and it can move money.
The version you send instead
Reach me at [EMAIL_1] or [PHONE_1] if it is urgent.
DB_HOST=[HOST_1]
DB_PASSWORD="[SECRET_1]"
STRIPE_KEY=[API_KEY_1]
export GITHUB_TOKEN=[API_KEY_2]
curl -H "Authorization: Bearer [API_KEY_3]" \
https://[HOST_2].acme-corp.com/v2/deploy
Order #113-7782991-4406620 is blocked by this.Why the answer is still good
Look at what survived. Every variable name is intact: DB_HOST, DB_PASSWORD, STRIPE_KEY, GITHUB_TOKEN. The curl command keeps its structure, its header name, its path. The shape of the problem is completely preserved.
An assistant reading this can still tell you that you are using a live Stripe key in a staging deploy, that your API hostname resolves internally and will not work from the runner, or that the Bearer header is malformed. None of those diagnoses need the actual values.
That is the general property worth internalising: debugging almost never requires the secret itself. It requires knowing that a secret is present, what it is called, and where it is being used. Placeholders keep all three.
What was deliberately left alone
The order number 113-7782991-4406620 is untouched. It is not sensitive, and it is probably the thing you need help tracing. A tool that redacted it would be making your question worse for no gain, which is why card detection stays off by default and why long digit runs are not flagged on sight.
The part the tool did not do
The message says "staging" and names acme-corp. If your employer's name is confidential in this context, or if "Falcon" appeared in a branch name, none of the rules would catch it. That is the manual pass, and this example is a good illustration of why it is still needed after a clean scan.