Assume the Prompt Leaves Your Network

When you paste a stack trace into a coding model, you have already crossed a trust boundary. The model is not a coworker on your VPN, and it does not inherit your log retention rules. Treat every prompt as outbound traffic you cannot recall, because caches, vendors, and reviewers may keep copies. The useful habit is not abstinence from assistants; it is a pre-flight check that strips secrets before the request leaves your machine.

You already treat production deploys this way, refusing to commit an AWS key or paste a customer dump into a public ticket. A coding assistant sits on the same side of the fence as that ticket: useful, remote, and outside the room where secrets belong. If vibe coding feels fast this week, the hidden cost is often a repo-sized paste that includes environment files and session cookies.

Draw the waterline before you type

Picture your laptop as a ship and the model as a harbor crane that unloads whatever you put on deck. Everything above the waterline can be shown to the crane; everything below it stays sealed in the hull. Source that is already public, failing tests, and redacted diffs usually sit above that painted line. Database URLs, refresh tokens, customer payloads, and staging cookies sit below it, even inside a log that looks harmless.

Once you name that waterline, the argument stops being moral and becomes operational for every paste. You either scan the payload, or you accept that the crane can see the hull without asking your security team. That choice is the whole method, and it belongs next to the editor rather than in a yearly training deck.

A practical waterline is boring on purpose, and that boredom is the feature you want in a hurry. If a string can mint access, identify a person, or map an internal network, it does not travel. If a string is a public API shape, a stack frame, or a failing assertion, it can travel after nearby comments lose ticket IDs. You are not trying to starve the model of context so much as keep a leaked prompt equal to a public issue.

What actually rides along in a small paste

Developers rarely paste a secret because they enjoy risk or because they forgot that credentials exist. They paste a file because the assistant asked for the full module, and that module imports settings that read the environment. The local shell still holds yesterday's cluster token, so the prompt looks like code review while the packet looks like an incident. You can watch the failure with a short Python example that nobody would call sensitive until you print what the process can see.

# demo_settings.py — labeled example, do not run against real credentials
import os

DATABASE_URL = os.environ.get("DATABASE_URL", "postgres://localhost/app")
STRIPE_KEY = os.environ.get("STRIPE_SECRET_KEY", "")
INTERNAL_HOST = os.environ.get("MESH_HOST", "payments.svc.cluster.local")

def debug_bundle():
    return {
        "db": DATABASE_URL,
        "billing": STRIPE_KEY[:7] + "..." if STRIPE_KEY else "unset",
        "mesh": INTERNAL_HOST,
    }

If you ask why checkout returns 500 and attach that debug bundle, you handed over a credential prefix and a mesh name. Truncating a key to seven characters is not redaction; it is a hint that still belongs in a secrets incident. The safer bundle is a schema and a fake value that preserves type without preserving access to anything real.

# labeled example: what you send instead of live values
SAFE_BUNDLE = {
    "db": "postgres://USER:REDACTED@127.0.0.1:5432/app",
    "billing": "sk_test_REDACTED",
    "mesh": "payments.internal.example",
    "error": "TimeoutError after 30s on POST /checkout",
}

Notice that the model still receives the shape of the failure without receiving the password or the real mesh DNS name. That is enough context for a patch and little enough context for a vendor log you will not see next quarter. You should prefer this trade every time the alternative is teaching a remote system how your staging network is wired.

A pre-flight gate you can run locally

You do not need a platform change to start this habit on an ordinary laptop this afternoon. You need a gate that refuses to copy a prompt until high-risk patterns have been removed from the buffer. The script below is a local filter, not a security product, and a match should be a hard stop. Run it on the file or snippet you are about to paste, then rewrite until the process exits cleanly.

#!/usr/bin/env python3
"""preflight_prompt.py — labeled local scanner, not a guarantee."""
import re
import sys
from pathlib import Path

PATTERNS = [
    ("aws_access_key", re.compile(r"AKIA[0-9A-Z]{16}")),
    ("generic_bearer", re.compile(r"(?i)bearer\s+[A-Za-z0-9._-]+")),
    ("pem_block", re.compile(r"-----BEGIN (?:RSA )?PRIVATE KEY-----")),
    ("jwt_like", re.compile(r"eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+")),
    ("connection_string", re.compile(r"(?i)(postgres|mysql|mongodb)://\S+")),
    ("env_assignment", re.compile(r"(?i)(api_key|secret|token|password)\s*=\s*\S+")),
    ("private_ipv4", re.compile(r"\b10(?:\.\d{1,3}){3}\b")),
    ("rfc1918_172", re.compile(r"\b172\.(1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2}\b")),
]

def scan(text: str) -> list[tuple[str, str]]:
    hits = []
    for name, rx in PATTERNS:
        for m in rx.finditer(text):
            snippet = m.group(0)
            clipped = snippet[:18] + "…" if len(snippet) > 18 else snippet
            hits.append((name, clipped))
    return hits

def main() -> int:
    if len(sys.argv) != 2:
        print("usage: preflight_prompt.py PATH", file=sys.stderr)
        return 2
    payload = Path(sys.argv[1]).read_text(encoding="utf-8", errors="replace")
    hits = scan(payload)
    if not hits:
        print("preflight: no high-risk patterns; still review by hand")
        return 0
    print("preflight: refuse to send until you rewrite these matches")
    for name, clipped in hits:
        print(f"  - {name}: {clipped}")
    return 1

if __name__ == "__main__":
    raise SystemExit(main())

Wire it to the copy step you already use so the chat window cannot outrun your patience.

python3 preflight_prompt.py /tmp/prompt.md && cat /tmp/prompt.md
# labeled example: only copy after a zero exit

If the scanner exits one, you do not paste, because a failed gate is cheaper than a rotation drill. You rewrite the snippet until the command exits zero, and then you still read the file, because regular expressions are not a legal team. Private IPv4 matches will false-positive on diagrams, and that pause is acceptable compared with a credential in someone else's log. A false positive wastes a minute; a false negative becomes an incident you explain with a screenshot of a chat box.

A small table beside the terminal

Use this compact table when you are unsure whether a snippet belongs above the waterline or below it.

Payload you want to send	Crosses the waterline?	What to send instead
Failing unit test and assertion	Usually no	The test, the expected value, the truncated stack
.env or secrets.yaml	Always yes	Names of keys only, with fake values
Production access logs	Yes, if they identify users	One synthetic line plus status codes
A JWT from a local login	Always yes	Header alg and a note that sub exists
Internal RFC1918 addresses	Yes	10.x rewritten to net-a.example
Open-source library error	Usually no	Version pin and the error string

Keep the table short so you will actually use it when a model is waiting and a deadline is closer than a policy review. The point is not completeness; the point is a default of redact-then-ask, which inverts the habit of dumping a repository and hoping. When a row is ambiguous, you shrink the paste rather than enlarge the model's memory of your private network.

Logs are a second copy of the same mistake

The prompt is not the only place a secret lives after you hit send in a browser tab. Extensions, local agent traces, CI jobs that echo the assistant, and share-thread buttons all create extra copies you will forget. If your team reviews assistant transcripts the way you review pull requests, those transcripts become a corpus with weaker access control than git. You should assume a coworker will search that corpus for the checkout fix and will find whatever you pasted.

A small discipline helps here, because the second copy is how last quarter's debug session becomes this quarter's audit question. Name the local transcript file, keep it out of git, and run the same preflight on it before you attach it to a ticket.

echo "transcripts/" >> .gitignore
python3 preflight_prompt.py transcripts/checkout-timeout.md

That extra command is dull, which is the point, because dull gates survive Friday deploys better than slogans do.

If you use a remote coding assistant, ask where prompts are stored, who can read them, and whether human review is on by default. You do not need a brochure to start that conversation with the same questions you already ask a log aggregator. Retention, region, and whether delete means delete are more useful than a feature list when the payload might include a token.

MonkeyCode can sit in that remote slot when you want a coding model without standing up your own inference box. Disclosure: This article was prepared as part of MonkeyCode's product outreach, covering only free model access and a free server option. That is enough to practice this redaction workflow on throwaway snippets, and it is not a reason to skip the scanner. A free endpoint still lives outside your hull, so try it with the redacted test and the fake bundle rather than the vault.

Limitations, and who should skip this

This scanner will miss secrets that do not look like secrets to a regular expression on a laptop. A customer surname in a comment, a signed cookie that is not a JWT, and a headerless base64 blob will walk through. It will also nag you about private addresses in architecture diagrams you actually intended to share with a teammate. Regex is a seatbelt rather than an airbag, and it does not replace a secrets manager or a company DLP tool.

Do not use this approach as a compliance program for regulated health data, cardholder data, or government systems that already have a vendor list. Those workloads need a written policy, a reviewed processor, and a default of local models or no remote models at all. Do not send them through a public or free remote endpoint, including a free MonkeyCode server, because price does not move the boundary. Hobby projects, public open-source debugging, and synthetic fixtures are the right blast radius for this particular habit.

The conclusion stays the one you started with, because the boundary did not get softer while you were reading. You can let an assistant write the patch, but you cannot let it inherit your network or your customer table. Draw the waterline, run the gate, and paste the diff rather than the vault that made the test fail. That habit is slower than a full-repo dump by about thirty seconds, and faster than rotating every token you mailed to a crane.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.