The Repro Packet Is a Keyring

When an HTTP client fails in staging, you usually paste the request into a coding model for a second reading. The status code, the path, and the timing of that request are the parts that explain the failure. The Authorization header, the session cookie, and any signed query parameter do not explain the failure at all. They only copy a live credential into a context window that you do not operate or retain.

You already refuse to drop production passwords into a casual chat, and that instinct is correct. Debug paste is still the path where those same secrets leave the laptop in practice. A copied curl from DevTools, a HAR export, or a CI log that looks truncated can still carry hostnames and bearer tokens. Once that packet reaches a remote model or a remote execution host, the credential is no longer a local note.

Treat every repro packet as a keyring that happens to include a stack trace, not as a sanitized story about a bug. The model needs the shape of the request, the status, and the server's error body after tokens are gone. It does not need to impersonate you against the same origin you just failed to call. If a field would let a stranger finish the request, that field stays on your side of the cable.

Here is a typical paste that looks like documentation and behaves like a session dump. Developers copy it because the command is the fastest way to show what they ran. Notice how little of the interesting failure lives in the secret material. The 403 is in routing and policy, not in the bearer string.

curl -sS -D - -o /tmp/body.txt \
  'https://billing.internal.example/v2/invoices?range=2026-09-01' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.example' \
  -H 'Cookie: session=s3cret.flag; csrf=abc' \
  -H 'X-Request-Id: 6f1c2e8a-9b44-4c21-a11e-0d33b7c91aa2' \
  -H 'Content-Type: application/json'

The hostname tells you the service, and the path tells you which resource the client actually hit. The request id tells you which line to find in logs you already control on your side. The bearer token and the session cookie tell a remote model how to become you during that same call. Keep the first three, drop the last two, and you still have a repro the model can reason about.

A small classifier makes that split explicit so you do not rely on late-night judgment during an incident. Save the script next to your notes and run it on any curl command you are about to paste. It is not a security product; it is a labeled preflight that fails closed on headers it does not recognize. Unknown headers join the hold set because novelty is how new auth schemes arrive in ordinary traces.

#!/usr/bin/env python3
"""Classify curl -H lines before they enter a remote prompt. Label, do not guess."""
from __future__ import annotations

import re
import sys

SEND = {
    "accept",
    "accept-language",
    "content-type",
    "if-none-match",
    "user-agent",
    "x-request-id",
    "x-correlation-id",
}
HOLD = {
    "authorization",
    "proxy-authorization",
    "cookie",
    "set-cookie",
    "x-api-key",
    "x-amz-security-token",
}

HEADER_RE = re.compile(r"^-H\s+['\"]?([^:'\"]+)\s*:\s*(.*?)['\"]?$")

def classify(line: str) -> tuple[str, str, str]:
    raw = line.strip().rstrip("\\").strip()
    match = HEADER_RE.match(raw)
    if not match:
        return ("unknown", "", raw)
    name, value = match.group(1).lower(), match.group(2)
    if name in HOLD or name.startswith("x-api-"):
        return ("hold", name, "<redacted>")
    if name in SEND:
        return ("send", name, value)
    return ("hold", name, "<redacted-unlisted>")

def main() -> None:
    for line in sys.stdin:
        if "-H" not in line:
            sys.stdout.write(line)
            continue
        verdict, name, shown = classify(line)
        if verdict == "send":
            sys.stdout.write(f"-H '{name}: {shown}'\n")
        else:
            sys.stderr.write(f"# HOLD {name or 'unparsed'}: do not paste\n")

if __name__ == "__main__":
    main()

Run it as a filter against the command you copied from the ticket or the chat thread. Anything written to standard error is a field that does not belong in the remote prompt. Standard output is the only text you should consider sending across a model or tool boundary. If the filter holds a header you believe is harmless, describe that header in prose instead of restoring it.

python3 classify_curl_headers.py < repro.curl > scrubbed.curl 2> hold.notes
cat hold.notes   # read this; do not paste it
cat scrubbed.curl

That split is the threat model, and it does not depend on which vendor owns the remote hop. Your editor is a trusted zone because you can delete a buffer and watch the bytes leave disk. A remote model is an untrusted zone because the prompt becomes provider-side input without your retention controls. A remote execution server is a second untrusted zone, because tool arguments, retries, and stdout can echo the same header.

Logs and search indexes around those systems are a third copy of whatever you thought you removed. Saying you already deleted the token from the file is not the same as saying it never crossed. Retries are especially noisy, because a failed tool call often reprints its arguments into the next prompt. If you must retry, retry the scrubbed packet, not the original shell history sitting in your scrollback.

If you use MonkeyCode here, treat free model access and the free server option as untrusted zones rather than a local scratchpad. Disclosure: This article was prepared as part of MonkeyCode's product outreach, which is the only reason the product appears in this walkthrough. A free remote hop is easy to click and easy to confuse with an offline review of the same failing request. Classify the repro on your laptop first, then paste only the send set if you still want a free remote reading.

When the model can call tools, the allowlist on the tool name is not a filter on the argument. You may permit an HTTP helper because fetching a public status page seems harmless during a late debug session. The model will fill that argument from whatever still sits in the conversation, including a bearer token pasted five messages earlier. An allowlisted tool with an unbounded argument is a side channel that looks like ordinary productivity.

A Kubernetes event dump has the same shape as that copied curl command from the browser. The describe output prints image names and restart counts that a remote model can actually use during diagnosis. It also prints environment variables that your manifest still injects as plaintext, plus volume paths that map toward cloud credentials. If you need help with CrashLoopBackOff, send the probe configuration and the last event reason rather than a complete describe that smuggles keys.

HAR files are worse than curl because they look like performance documents while storing request and response cookies together. Exporting one from the Network panel is a reasonable local habit when you are chasing a redirect loop. Uploading that file into a prompt is not a performance review; it is a bulk transfer of every header the browser sent. Extract timings and status codes locally, then type the sequence of paths in your own words for the model.

Keep a decision table beside the classifier so the team argues about fields once, not during an outage. Send fields that describe protocol shape, and hold fields that authenticate, authorize, or identify a person. When a field is both diagnostic and identifying, hold it and describe the meaning in your own words. The table is a policy you can diff in git, which is more durable than a memory of last week's close call.

Artifact field	Role in the bug	Cross the remote hop?
Authorization, Cookie, x-api-key	Proves identity	No, never
Signed query (X-Amz-Signature, token=)	Proves identity	No, rewrite the URL
X-Request-Id, correlation id	Finds local logs	Yes, after you confirm it is not a session
Host + path + status	Locates the failure	Yes
Response body with PII	Explains business logic	No, replace with a fixture
Env from docker inspect	Configures the process	No, summarize the missing key name only

This classifier will miss tokens that sit in JSON bodies, basic auth inside the URL, and cookies stuffed into query strings. It will also miss MCP binary attachments and screenshots of the same header bar from a phone camera. Regex over curl is a seatbelt, not a vault, and you should not treat a quiet run as proof the prompt is clean. If your threat model forbids any off-machine analysis, skip remote models entirely and keep the trace in an internal ticket.

People handling payment credentials, medical identifiers, or workplace identity cookies should not paste traces into any remote model. The workflow above is for staging bugs where the useful signal is routing, and where you can replace bodies with fixtures. It is the wrong workflow for incident response on a live tenant, because speed will talk you into sending the hold set. It is also wrong if your company already provides an isolated review environment with a retention policy you actually trust.

If you want a remote second reading, give the model a scrubbed curl and a fake body that still returns the same status. Keep the real keyring in local history where a revoke is still possible after you notice a bad paste. A remote hop can wait until the hold set is empty, even when the model and the server happen to be free. The bug usually lives in routing or serialization, and the credential is almost never the missing clue you needed.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.