You should treat every paste into a remote coding model as a copy you cannot delete later. The model might be free, the server might be complimentary, and the session might look ephemeral, but the bytes still left your machine. A crash dump, an env print, or a failing request log is not a private note once it crosses that hop. If you would not email the same text to a vendor, you should not drop it into a prompt.
The trust boundary sits at the moment text leaves your process and enters someone else's runtime. Your laptop, your container, and your test runner stay inside that line until you copy output into a chat. After that hop, you have created a second copy whose retention, access, and backups you do not control. A complimentary model endpoint is still a foreign disk with logs, even when the invoice is empty.
Think of the prompt box as a loading dock rather than a scratch pad beside your terminal. You can wheel a pallet of logs onto that dock in a single paste, and the truck leaves without a receipt. The analogy is imperfect, because a dock at least has cameras and a bill of lading you can later request. A model session often gives you neither, which is why the filter has to run on your side first.
Most painful leaks are not the function under review, but the debris that travels with a failing run. A Python traceback can echo a database URL, a request dump can echo an Authorization header, and a Docker inspect can echo a password. Those strings were never the question you wanted answered, yet they ride along because you pasted the whole pane. You can break that habit with a local gate that treats stdin as hostile until proven dull.
The proposed gate below is a filter, not a security product, and it will miss clever encodings. Run it on your machine, point it at the text you were about to paste, and only then involve a remote model. Keep the original log in a local file that never leaves the disk you already encrypt. Treat anything that survives the filter as still possibly sensitive, because regular expressions are a blunt instrument.
#!/usr/bin/env python3
"""redact_debug_paste.py
Proposed local gate for debug text you might paste into a remote model.
This is an unexecuted example: review it, then run it against synthetic fixtures.
It is not a DLP system and it will not catch every secret format.
"""
from __future__ import annotations
import argparse
import re
import sys
from pathlib import Path
RULES: list[tuple[re.Pattern[str], str]] = [
(re.compile(r"(?im)^(authorization:\s*bearer\s+)\S+"), r"\1[REDACTED]"),
(re.compile(r"(?i)(api[_-]?key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
(re.compile(r"(?i)(secret[_-]?key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
(re.compile(r"(?i)(password\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
(re.compile(r"(?i)(passwd\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
(re.compile(r"(?i)(token\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
(re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]+\b"), "[JWT_REDACTED]"),
(re.compile(r"\bAKIA[0-9A-Z]{16}\b"), "[AWS_KEY_ID_REDACTED]"),
(re.compile(r"(?i)(aws_secret_access_key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
(re.compile(r"(?i)((?:postgres|mysql|mongodb|redis|amqp)://)[^\s]+"), r"\1[REDACTED]"),
(
re.compile(
r"(?i)(-----BEGIN (?:RSA )?PRIVATE KEY-----)(.*?)(-----END (?:RSA )?PRIVATE KEY-----)",
re.S,
),
r"\1\n[REDACTED]\n\3",
),
(re.compile(r"(?i)(x-api-key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
(re.compile(r"(?i)(set-cookie:\s*)[^\n]+"), r"\1[REDACTED]"),
(re.compile(r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.I), "[EMAIL_REDACTED]"),
]
def redact(text: str) -> str:
for pattern, repl in RULES:
text = pattern.sub(repl, text)
return text
def main() -> int:
parser = argparse.ArgumentParser(description="Redact common secrets from debug text.")
parser.add_argument("path", nargs="?", help="File to read; defaults to stdin")
parser.add_argument("-o", "--out", help="Write redacted text here instead of stdout")
args = parser.parse_args()
raw = Path(args.path).read_text(encoding="utf-8") if args.path else sys.stdin.read()
cleaned = redact(raw)
if args.out:
Path(args.out).write_text(cleaned, encoding="utf-8")
else:
sys.stdout.write(cleaned)
return 0
if __name__ == "__main__":
raise SystemExit(main())
You can hang this script on the end of a failing command so the paste buffer never holds the raw pane. The commands below are the intended workflow, labeled as a proposal rather than a measured run. Swap the test path for the module that actually broke on your checkout before you pipe anything.
chmod +x redact_debug_paste.py
# Capture a failing test run, then keep only the redacted copy for later paste.
pytest app/tests/test_billing.py -vv --tb=short 2>&1 | tee /tmp/raw-fail.log | ./redact_debug_paste.py > /tmp/safe-fail.log
# Inspect what the gate changed before you touch any chat box.
diff -u /tmp/raw-fail.log /tmp/safe-fail.log | less
# Optional: copy the safe file, never the raw one.
pbcopy < /tmp/safe-fail.log # macOS
# xclip -selection clipboard < /tmp/safe-fail.log # Linux
A second command is worth keeping around for container noise, because compose files and inspect output are dense with connection strings. Pipe only the service that failed, and drop volumes and env blocks that the model does not need. The model can reason about a redacted URL scheme without ever seeing the password or the host.
docker compose logs payments --tail=200 2>&1 | ./redact_debug_paste.py > /tmp/safe-compose.log
# Proposed fixture: synthesize the error instead of exporting production.
cat > /tmp/synthetic-fail.txt <<'EOF'
Traceback (most recent call last):
File "payments/charge.py", line 88, in charge
client.capture(payment_id)
psycopg2.OperationalError: connection refused
DSN=postgres://[REDACTED]
Authorization: Bearer [REDACTED]
EOF
You should add a tiny self-check so the gate cannot silently rot after someone comments out a rule. The snippet below is a proposal you can drop next to the filter and run with pytest if you already use it. It does not prove absence of leaks, and it only proves the patterns you remembered still fire.
# test_redact_debug_paste.py — proposed checks, not a complete threat model.
from redact_debug_paste import redact
def test_bearer_and_dsn_die():
dirty = (
"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.aaa.bbb\n"
"DATABASE_URL=postgres://alice:hunter2@db.internal:5432/billing\n"
"user@example.com called charge()\n"
)
clean = redact(dirty)
assert "hunter2" not in clean
assert "Bearer eyJ" not in clean
assert "alice" not in clean
assert "[REDACTED]" in clean
assert "[EMAIL_REDACTED]" in clean
Now the question is what still belongs in the prompt after the filter has done its pass. You want the shape of the failure, the names of the functions, and the assertion that died. You do not want customer identifiers, session cookies, private hostnames that map to production, or the contents of an env file. If the model needs a configuration sketch, write a fake one with obvious placeholders a contractor could see in a lobby.
That last habit matters when the assistant lives on a free endpoint you do not operate. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source coding assistant with free model access and a free server option. Use that endpoint on redacted fixtures and synthetic errors, not on a living incident that still contains tokens.
A useful check, written here as prose on purpose, is to ask three questions before the hop. Would this text be awkward in a public GitHub issue or in a vendor support ticket. Would this text still explain the bug if every credential became the word REDACTED. If the third answer is yes, you already have the prompt you needed without the extra debris.
There is a second class of leak that the script will not see, and you should not pretend otherwise. Editor plugins that upload a repository, and agents that read files you did not paste, both bypass stdin. A filter on a log file does nothing if the client ships a home directory or a dumped core as context. Disable automatic folder upload until you know the allow list, and keep secrets in a directory the agent cannot read.
The approach also fails when people treat a green self-check as a clearance stamp for the hop. Regular expressions miss tokens in base64 blobs, in truncated headers, and in screenshots this workflow never reads. Unicode tricks, split secrets across lines, and custom headers will sail through without a single match. If your world is PCI or HIPAA, this script is not your control, and you need a reviewed DLP path.
Who should skip this workflow is as important as who might try it on a Tuesday. Do not use a remote model as the first reader of a production crash when policy forbids off-box operational data. Do not use this filter as a reason to relax that policy after a noisy on-call night. Do not paste onto a complimentary server when the incident involves customer data, even if passwords look redacted.
If the bug only reproduces with a live secret, you have a design problem, not a prompting problem. Mock the credential, freeze a fixture, and make the failure mechanical on your own laptop before any paste. Then the text you send to any assistant is something you could publish without paging legal. That is the entire point of the gate: shrink the prompt until it looks like code review, not an incident export.
When you do try a remote assistant after the filter, send the smallest bundle that still fails. A twenty-line function and a redacted assertion will beat a four-hundred-line compose log every time. Keep the raw log in an encrypted local folder, and keep the chat side boring on purpose. If you try MonkeyCode, send a synthetic traceback through the gate first, then use the free server on that boring fixture.
Top comments (1)
The loading dock analogy is the right framing for the trust boundary: you can wheel a pallet of logs onto the dock in one paste and the truck leaves without a receipt. The thing that travels isn't the function under review, it's the debris — traceback echoing a DB URL, request dump echoing an Authorization header, Docker inspect echoing a password. Those strings were never part of the question.
The script is a reasonable starting gate. The pattern list covers the obvious cases: bearer tokens, JWT format, AWS key IDs, connection strings, private keys. The diff step before touching any chat box is the right habit — inspect what the gate changed before sending anything. Keeping the raw log only in a local encrypted file and only ever pasting the safe copy is the operationally correct workflow.
The honest limits are where this post earns trust. Base64 blobs, split secrets across lines, Unicode tricks, custom headers — regular expressions are a blunt instrument and calling that out directly prevents the false-clearance-stamp problem. The green self-check is not a DLP clearance.
The 'if the bug only reproduces with a live secret, you have a design problem not a prompting problem' line is the sharpest observation. Mock the credential, freeze a fixture, make the failure mechanical on your laptop first. Then what you send to any assistant could be published without paging legal. That's the actual target state.