What not to paste into AI
Real leak cases, what each AI vendor keeps, and how to redact before you share.
Our phone rule misses German numbers on purpose
It catches five of nine formats we tested. The four it misses are the price of never flagging a version number, a date, or an order ID.
Three dots do not make a JWT
The obvious way to detect a JSON Web Token matches version strings, file paths and Sentry DSNs. One extra constraint removes all of them, and it comes free from the spec.
We tested 26 API key formats. Ours catches 21.
Seventeen of our 28 patterns exist just for API keys, and they still miss five vendors we could name. Here is the full result table and why the gaps are where they are.