DEV Community: Riley Lin

The Debug Paste Is a Data Transfer

Riley Lin — Sun, 20 Sep 2026 11:39:30 +0000

You should treat every paste into a remote coding model as a copy you cannot delete later. The model might be free, the server might be complimentary, and the session might look ephemeral, but the bytes still left your machine. A crash dump, an env print, or a failing request log is not a private note once it crosses that hop. If you would not email the same text to a vendor, you should not drop it into a prompt.

The trust boundary sits at the moment text leaves your process and enters someone else's runtime. Your laptop, your container, and your test runner stay inside that line until you copy output into a chat. After that hop, you have created a second copy whose retention, access, and backups you do not control. A complimentary model endpoint is still a foreign disk with logs, even when the invoice is empty.

Think of the prompt box as a loading dock rather than a scratch pad beside your terminal. You can wheel a pallet of logs onto that dock in a single paste, and the truck leaves without a receipt. The analogy is imperfect, because a dock at least has cameras and a bill of lading you can later request. A model session often gives you neither, which is why the filter has to run on your side first.

Most painful leaks are not the function under review, but the debris that travels with a failing run. A Python traceback can echo a database URL, a request dump can echo an Authorization header, and a Docker inspect can echo a password. Those strings were never the question you wanted answered, yet they ride along because you pasted the whole pane. You can break that habit with a local gate that treats stdin as hostile until proven dull.

The proposed gate below is a filter, not a security product, and it will miss clever encodings. Run it on your machine, point it at the text you were about to paste, and only then involve a remote model. Keep the original log in a local file that never leaves the disk you already encrypt. Treat anything that survives the filter as still possibly sensitive, because regular expressions are a blunt instrument.

#!/usr/bin/env python3
"""redact_debug_paste.py

Proposed local gate for debug text you might paste into a remote model.
This is an unexecuted example: review it, then run it against synthetic fixtures.
It is not a DLP system and it will not catch every secret format.
"""
from __future__ import annotations

import argparse
import re
import sys
from pathlib import Path

RULES: list[tuple[re.Pattern[str], str]] = [
    (re.compile(r"(?im)^(authorization:\s*bearer\s+)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(api[_-]?key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(secret[_-]?key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(password\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(passwd\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(token\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]+\b"), "[JWT_REDACTED]"),
    (re.compile(r"\bAKIA[0-9A-Z]{16}\b"), "[AWS_KEY_ID_REDACTED]"),
    (re.compile(r"(?i)(aws_secret_access_key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)((?:postgres|mysql|mongodb|redis|amqp)://)[^\s]+"), r"\1[REDACTED]"),
    (
        re.compile(
            r"(?i)(-----BEGIN (?:RSA )?PRIVATE KEY-----)(.*?)(-----END (?:RSA )?PRIVATE KEY-----)",
            re.S,
        ),
        r"\1\n[REDACTED]\n\3",
    ),
    (re.compile(r"(?i)(x-api-key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(set-cookie:\s*)[^\n]+"), r"\1[REDACTED]"),
    (re.compile(r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.I), "[EMAIL_REDACTED]"),
]


def redact(text: str) -> str:
    for pattern, repl in RULES:
        text = pattern.sub(repl, text)
    return text


def main() -> int:
    parser = argparse.ArgumentParser(description="Redact common secrets from debug text.")
    parser.add_argument("path", nargs="?", help="File to read; defaults to stdin")
    parser.add_argument("-o", "--out", help="Write redacted text here instead of stdout")
    args = parser.parse_args()
    raw = Path(args.path).read_text(encoding="utf-8") if args.path else sys.stdin.read()
    cleaned = redact(raw)
    if args.out:
        Path(args.out).write_text(cleaned, encoding="utf-8")
    else:
        sys.stdout.write(cleaned)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

You can hang this script on the end of a failing command so the paste buffer never holds the raw pane. The commands below are the intended workflow, labeled as a proposal rather than a measured run. Swap the test path for the module that actually broke on your checkout before you pipe anything.

chmod +x redact_debug_paste.py

# Capture a failing test run, then keep only the redacted copy for later paste.
pytest app/tests/test_billing.py -vv --tb=short 2>&1 | tee /tmp/raw-fail.log | ./redact_debug_paste.py > /tmp/safe-fail.log

# Inspect what the gate changed before you touch any chat box.
diff -u /tmp/raw-fail.log /tmp/safe-fail.log | less

# Optional: copy the safe file, never the raw one.
pbcopy < /tmp/safe-fail.log          # macOS
# xclip -selection clipboard < /tmp/safe-fail.log   # Linux

A second command is worth keeping around for container noise, because compose files and inspect output are dense with connection strings. Pipe only the service that failed, and drop volumes and env blocks that the model does not need. The model can reason about a redacted URL scheme without ever seeing the password or the host.

docker compose logs payments --tail=200 2>&1 | ./redact_debug_paste.py > /tmp/safe-compose.log

# Proposed fixture: synthesize the error instead of exporting production.
cat > /tmp/synthetic-fail.txt <<'EOF'
Traceback (most recent call last):
  File "payments/charge.py", line 88, in charge
    client.capture(payment_id)
psycopg2.OperationalError: connection refused
DSN=postgres://[REDACTED]
Authorization: Bearer [REDACTED]
EOF

You should add a tiny self-check so the gate cannot silently rot after someone comments out a rule. The snippet below is a proposal you can drop next to the filter and run with pytest if you already use it. It does not prove absence of leaks, and it only proves the patterns you remembered still fire.

# test_redact_debug_paste.py — proposed checks, not a complete threat model.
from redact_debug_paste import redact

def test_bearer_and_dsn_die():
    dirty = (
        "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.aaa.bbb\n"
        "DATABASE_URL=postgres://alice:hunter2@db.internal:5432/billing\n"
        "user@example.com called charge()\n"
    )
    clean = redact(dirty)
    assert "hunter2" not in clean
    assert "Bearer eyJ" not in clean
    assert "alice" not in clean
    assert "[REDACTED]" in clean
    assert "[EMAIL_REDACTED]" in clean

Now the question is what still belongs in the prompt after the filter has done its pass. You want the shape of the failure, the names of the functions, and the assertion that died. You do not want customer identifiers, session cookies, private hostnames that map to production, or the contents of an env file. If the model needs a configuration sketch, write a fake one with obvious placeholders a contractor could see in a lobby.

That last habit matters when the assistant lives on a free endpoint you do not operate. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source coding assistant with free model access and a free server option. Use that endpoint on redacted fixtures and synthetic errors, not on a living incident that still contains tokens.

A useful check, written here as prose on purpose, is to ask three questions before the hop. Would this text be awkward in a public GitHub issue or in a vendor support ticket. Would this text still explain the bug if every credential became the word REDACTED. If the third answer is yes, you already have the prompt you needed without the extra debris.

There is a second class of leak that the script will not see, and you should not pretend otherwise. Editor plugins that upload a repository, and agents that read files you did not paste, both bypass stdin. A filter on a log file does nothing if the client ships a home directory or a dumped core as context. Disable automatic folder upload until you know the allow list, and keep secrets in a directory the agent cannot read.

The approach also fails when people treat a green self-check as a clearance stamp for the hop. Regular expressions miss tokens in base64 blobs, in truncated headers, and in screenshots this workflow never reads. Unicode tricks, split secrets across lines, and custom headers will sail through without a single match. If your world is PCI or HIPAA, this script is not your control, and you need a reviewed DLP path.

Who should skip this workflow is as important as who might try it on a Tuesday. Do not use a remote model as the first reader of a production crash when policy forbids off-box operational data. Do not use this filter as a reason to relax that policy after a noisy on-call night. Do not paste onto a complimentary server when the incident involves customer data, even if passwords look redacted.

If the bug only reproduces with a live secret, you have a design problem, not a prompting problem. Mock the credential, freeze a fixture, and make the failure mechanical on your own laptop before any paste. Then the text you send to any assistant is something you could publish without paging legal. That is the entire point of the gate: shrink the prompt until it looks like code review, not an incident export.

When you do try a remote assistant after the filter, send the smallest bundle that still fails. A twenty-line function and a redacted assertion will beat a four-hundred-line compose log every time. Keep the raw log in an encrypted local folder, and keep the chat side boring on purpose. If you try MonkeyCode, send a synthetic traceback through the gate first, then use the free server on that boring fixture.

Assume the Prompt Leaves Your Network

Riley Lin — Sat, 19 Sep 2026 09:43:55 +0000

When you paste a stack trace into a coding model, you have already crossed a trust boundary. The model is not a coworker on your VPN, and it does not inherit your log retention rules. Treat every prompt as outbound traffic you cannot recall, because caches, vendors, and reviewers may keep copies. The useful habit is not abstinence from assistants; it is a pre-flight check that strips secrets before the request leaves your machine.

You already treat production deploys this way, refusing to commit an AWS key or paste a customer dump into a public ticket. A coding assistant sits on the same side of the fence as that ticket: useful, remote, and outside the room where secrets belong. If vibe coding feels fast this week, the hidden cost is often a repo-sized paste that includes environment files and session cookies.

Draw the waterline before you type

Picture your laptop as a ship and the model as a harbor crane that unloads whatever you put on deck. Everything above the waterline can be shown to the crane; everything below it stays sealed in the hull. Source that is already public, failing tests, and redacted diffs usually sit above that painted line. Database URLs, refresh tokens, customer payloads, and staging cookies sit below it, even inside a log that looks harmless.

Once you name that waterline, the argument stops being moral and becomes operational for every paste. You either scan the payload, or you accept that the crane can see the hull without asking your security team. That choice is the whole method, and it belongs next to the editor rather than in a yearly training deck.

A practical waterline is boring on purpose, and that boredom is the feature you want in a hurry. If a string can mint access, identify a person, or map an internal network, it does not travel. If a string is a public API shape, a stack frame, or a failing assertion, it can travel after nearby comments lose ticket IDs. You are not trying to starve the model of context so much as keep a leaked prompt equal to a public issue.

What actually rides along in a small paste

Developers rarely paste a secret because they enjoy risk or because they forgot that credentials exist. They paste a file because the assistant asked for the full module, and that module imports settings that read the environment. The local shell still holds yesterday's cluster token, so the prompt looks like code review while the packet looks like an incident. You can watch the failure with a short Python example that nobody would call sensitive until you print what the process can see.

# demo_settings.py — labeled example, do not run against real credentials
import os

DATABASE_URL = os.environ.get("DATABASE_URL", "postgres://localhost/app")
STRIPE_KEY = os.environ.get("STRIPE_SECRET_KEY", "")
INTERNAL_HOST = os.environ.get("MESH_HOST", "payments.svc.cluster.local")

def debug_bundle():
    return {
        "db": DATABASE_URL,
        "billing": STRIPE_KEY[:7] + "..." if STRIPE_KEY else "unset",
        "mesh": INTERNAL_HOST,
    }

If you ask why checkout returns 500 and attach that debug bundle, you handed over a credential prefix and a mesh name. Truncating a key to seven characters is not redaction; it is a hint that still belongs in a secrets incident. The safer bundle is a schema and a fake value that preserves type without preserving access to anything real.

# labeled example: what you send instead of live values
SAFE_BUNDLE = {
    "db": "postgres://USER:REDACTED@127.0.0.1:5432/app",
    "billing": "sk_test_REDACTED",
    "mesh": "payments.internal.example",
    "error": "TimeoutError after 30s on POST /checkout",
}

Notice that the model still receives the shape of the failure without receiving the password or the real mesh DNS name. That is enough context for a patch and little enough context for a vendor log you will not see next quarter. You should prefer this trade every time the alternative is teaching a remote system how your staging network is wired.

A pre-flight gate you can run locally

You do not need a platform change to start this habit on an ordinary laptop this afternoon. You need a gate that refuses to copy a prompt until high-risk patterns have been removed from the buffer. The script below is a local filter, not a security product, and a match should be a hard stop. Run it on the file or snippet you are about to paste, then rewrite until the process exits cleanly.

#!/usr/bin/env python3
"""preflight_prompt.py — labeled local scanner, not a guarantee."""
import re
import sys
from pathlib import Path

PATTERNS = [
    ("aws_access_key", re.compile(r"AKIA[0-9A-Z]{16}")),
    ("generic_bearer", re.compile(r"(?i)bearer\s+[A-Za-z0-9._-]+")),
    ("pem_block", re.compile(r"-----BEGIN (?:RSA )?PRIVATE KEY-----")),
    ("jwt_like", re.compile(r"eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+")),
    ("connection_string", re.compile(r"(?i)(postgres|mysql|mongodb)://\S+")),
    ("env_assignment", re.compile(r"(?i)(api_key|secret|token|password)\s*=\s*\S+")),
    ("private_ipv4", re.compile(r"\b10(?:\.\d{1,3}){3}\b")),
    ("rfc1918_172", re.compile(r"\b172\.(1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2}\b")),
]

def scan(text: str) -> list[tuple[str, str]]:
    hits = []
    for name, rx in PATTERNS:
        for m in rx.finditer(text):
            snippet = m.group(0)
            clipped = snippet[:18] + "…" if len(snippet) > 18 else snippet
            hits.append((name, clipped))
    return hits

def main() -> int:
    if len(sys.argv) != 2:
        print("usage: preflight_prompt.py PATH", file=sys.stderr)
        return 2
    payload = Path(sys.argv[1]).read_text(encoding="utf-8", errors="replace")
    hits = scan(payload)
    if not hits:
        print("preflight: no high-risk patterns; still review by hand")
        return 0
    print("preflight: refuse to send until you rewrite these matches")
    for name, clipped in hits:
        print(f"  - {name}: {clipped}")
    return 1

if __name__ == "__main__":
    raise SystemExit(main())

Wire it to the copy step you already use so the chat window cannot outrun your patience.

python3 preflight_prompt.py /tmp/prompt.md && cat /tmp/prompt.md
# labeled example: only copy after a zero exit

If the scanner exits one, you do not paste, because a failed gate is cheaper than a rotation drill. You rewrite the snippet until the command exits zero, and then you still read the file, because regular expressions are not a legal team. Private IPv4 matches will false-positive on diagrams, and that pause is acceptable compared with a credential in someone else's log. A false positive wastes a minute; a false negative becomes an incident you explain with a screenshot of a chat box.

A small table beside the terminal

Use this compact table when you are unsure whether a snippet belongs above the waterline or below it.

Payload you want to send	Crosses the waterline?	What to send instead
Failing unit test and assertion	Usually no	The test, the expected value, the truncated stack
`.env` or `secrets.yaml`	Always yes	Names of keys only, with fake values
Production access logs	Yes, if they identify users	One synthetic line plus status codes
A JWT from a local login	Always yes	Header `alg` and a note that `sub` exists
Internal RFC1918 addresses	Yes	`10.x` rewritten to `net-a.example`
Open-source library error	Usually no	Version pin and the error string

Keep the table short so you will actually use it when a model is waiting and a deadline is closer than a policy review. The point is not completeness; the point is a default of redact-then-ask, which inverts the habit of dumping a repository and hoping. When a row is ambiguous, you shrink the paste rather than enlarge the model's memory of your private network.

Logs are a second copy of the same mistake

The prompt is not the only place a secret lives after you hit send in a browser tab. Extensions, local agent traces, CI jobs that echo the assistant, and share-thread buttons all create extra copies you will forget. If your team reviews assistant transcripts the way you review pull requests, those transcripts become a corpus with weaker access control than git. You should assume a coworker will search that corpus for the checkout fix and will find whatever you pasted.

A small discipline helps here, because the second copy is how last quarter's debug session becomes this quarter's audit question. Name the local transcript file, keep it out of git, and run the same preflight on it before you attach it to a ticket.

echo "transcripts/" >> .gitignore
python3 preflight_prompt.py transcripts/checkout-timeout.md

That extra command is dull, which is the point, because dull gates survive Friday deploys better than slogans do.

If you use a remote coding assistant, ask where prompts are stored, who can read them, and whether human review is on by default. You do not need a brochure to start that conversation with the same questions you already ask a log aggregator. Retention, region, and whether delete means delete are more useful than a feature list when the payload might include a token.

MonkeyCode can sit in that remote slot when you want a coding model without standing up your own inference box. Disclosure: This article was prepared as part of MonkeyCode's product outreach, covering only free model access and a free server option. That is enough to practice this redaction workflow on throwaway snippets, and it is not a reason to skip the scanner. A free endpoint still lives outside your hull, so try it with the redacted test and the fake bundle rather than the vault.

Limitations, and who should skip this

This scanner will miss secrets that do not look like secrets to a regular expression on a laptop. A customer surname in a comment, a signed cookie that is not a JWT, and a headerless base64 blob will walk through. It will also nag you about private addresses in architecture diagrams you actually intended to share with a teammate. Regex is a seatbelt rather than an airbag, and it does not replace a secrets manager or a company DLP tool.

Do not use this approach as a compliance program for regulated health data, cardholder data, or government systems that already have a vendor list. Those workloads need a written policy, a reviewed processor, and a default of local models or no remote models at all. Do not send them through a public or free remote endpoint, including a free MonkeyCode server, because price does not move the boundary. Hobby projects, public open-source debugging, and synthetic fixtures are the right blast radius for this particular habit.

The conclusion stays the one you started with, because the boundary did not get softer while you were reading. You can let an assistant write the patch, but you cannot let it inherit your network or your customer table. Draw the waterline, run the gate, and paste the diff rather than the vault that made the test fail. That habit is slower than a full-repo dump by about thirty seconds, and faster than rotating every token you mailed to a crane.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The Agent Is a Subprocessor

Riley Lin — Fri, 18 Sep 2026 08:05:10 +0000

You should treat every coding-agent prompt as a network egress event, not as a private scratchpad. Secrets, customer dumps, and internal hostnames leave your control the moment they enter a context window. A cheap redaction pass before the call is more reliable than hoping a vendor will forget. The rest of this article turns that rule into a repeatable threat model and a small sanitizer you can run locally.

Coding assistants now sit inside the same loop where you reproduce bugs and paste stack traces. That convenience quietly collapses the old habit of keeping production clues on an isolated jump box. The model feels like a colleague on your laptop, which is why people paste .env files without flinching. Your threat model has to assume the opposite: the model is a processor you do not operate.

Picture four rooms with locked doors between them, even if the UI draws them as one chat. Room one is your workstation, including the repo, the shell history, and local secret stores. Room two is the agent runtime, which can read files, run commands, and assemble a context bundle. Room three is the model endpoint, and room four is whatever logs or eval traces that endpoint still retains.

Anything that walks from room one into room three has crossed a trust boundary you cannot reverse. Remote assistants make that crossing obvious, because the weights and the disks are visibly not yours. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option, which helps you rehearse the same workflow without pretending the bytes stayed local.

You do not send live credentials, session cookies, or private keys, even when the bug only reproduces with them. You do not send customer records, health data, or payroll extracts just to get a prettier SQL rewrite. You do not send internal architecture diagrams that name unreleased hostnames, jump boxes, or VPN paths. You also do not send other people's unreleased source, because a context window is not a license grant.

The quieter leak is not the prompt you remember; it is the transcript you forget. Agent products write session logs, tool traces, and sometimes prompt caches onto disk you do not inspect. If your company later issues a legal hold, that chat history can become a document you never meant to keep. Rotate the habit: assume every turn is written down, then decide whether that sentence should exist.

You cannot prompt your way out of a data-flow problem, because instructions are not a boundary. Telling the model to forget a key still placed the key in the request body. Vendors may train, debug, or cache that body under terms you have not read this week. The only reliable denial is omission, which means you never put that byte in the packet.

There is a time-of-check failure that many agent workflows quietly ignore when a deadline is close. You redact a copy, then the agent uses a file tool and reads the live path anyway. The trust boundary failed because the runtime still had permission to enter room one. Pin the agent to the redacted path, or disable file tools until the brief is clean.

The practical control is boring on purpose, which is why it still works under deadline pressure. You stage a context file, you run a local redactor, and only then do you let the agent read the file. The script below is an example you should adapt, not a compliance product and not a guarantee. It writes a receipt of every hit so you can see what almost left the building.

#!/usr/bin/env python3
"""Example context redactor. Adapt before use. Not a DLP product."""
from __future__ import annotations

import re
import sys
from pathlib import Path

PATTERNS = [
    ("aws_akid", re.compile(r"AKIA[0-9A-Z]{16}")),
    ("jwt", re.compile(r"eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}")),
    (
        "pem",
        re.compile(
            r"-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----"
        ),
    ),
    ("bearer", re.compile(r"(?i)(authorization:\s*bearer\s+)\S+")),
    (
        "url_cred",
        re.compile(
            r"(?i)((?:https|postgres|mysql|mongodb|redis)://)[^/\s:]+:[^@\s]+@"
        ),
    ),
    (
        "rfc1918",
        re.compile(
            r"\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|"
            r"192\.168\.\d{1,3}\.\d{1,3}|"
            r"172\.(?:1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3})\b"
        ),
    ),
    ("email", re.compile(r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.I)),
    (
        "env_secret",
        re.compile(
            r"(?im)^([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PWD))\s*=\s*.+$"
        ),
    ),
]


def redact(text: str) -> tuple[str, list[str]]:
    receipt: list[str] = []
    out = text
    for name, rx in PATTERNS:
        def repl(match: re.Match[str], label: str = name) -> str:
            receipt.append(f"{label}:{match.start()}")
            if match.lastindex:
                return match.group(1) + f"<REDACTED:{label}>"
            return f"<REDACTED:{label}>"

        out = rx.sub(repl, out)
    return out, receipt


def main() -> None:
    if len(sys.argv) != 2:
        print("usage: redact_context.py <file>", file=sys.stderr)
        sys.exit(2)
    src = Path(sys.argv[1])
    text = src.read_text(encoding="utf-8", errors="replace")
    cleaned, receipt = redact(text)
    out = Path(str(src) + ".redacted")
    rec = Path(str(src) + ".receipt")
    out.write_text(cleaned, encoding="utf-8")
    rec.write_text(("\n".join(receipt) + "\n") if receipt else "", encoding="utf-8")
    print(f"wrote {out} with {len(receipt)} hits; receipt {rec}")


if __name__ == "__main__":
    main()

Label the next block as an unexecuted example test, then run it only against synthetic fixtures you created. The point is not coverage theater; it is proving the redactor actually deletes the shapes you think it deletes. If this test fails on your laptop, you are not ready to brief an agent with a staging dump.

# Example test. Do not paste production tokens into this file.
def test_redact_jwt_and_env() -> None:
    sample = (
        "Authorization: Bearer eyJhbGciOiJub25lIn0.e30.fakesig\n"
        "STRIPE_SECRET_KEY=sk_live_example_not_real\n"
        "postgres://app:hunter2@10.0.4.12:5432/orders\n"
    )
    cleaned, receipt = redact(sample)
    assert "fakesig" not in cleaned
    assert "hunter2" not in cleaned
    assert "sk_live_example_not_real" not in cleaned
    assert "10.0.4.12" not in cleaned
    assert any(item.startswith("bearer:") for item in receipt)
    assert any(item.startswith("env_secret:") for item in receipt)

Run the example against a staging dump before any agent call, and keep the receipt beside the ticket. If the receipt is empty, you probably pointed the redactor at the wrong input file. If the receipt is huge, you are briefing the model with material that should have stayed in room one. Either outcome remains useful, because both results beat pasting a raw production log into chat.

A second local gate belongs at the repository edge, so tracked secrets never become default context. These ordinary commands stay on your machine and they do not phone home by themselves. They will not replace a vault, but they catch the cases that make incident reviews painful.

# Example local gate. Pin the agent to the redacted path only.
set -euo pipefail
src="${1:?usage: gate_context.sh <file>}"
python3 redact_context.py "$src"
redacted="${src}.redacted"
receipt="${src}.receipt"

if [ ! -s "$receipt" ]; then
  echo "receipt empty; confirm the redactor scanned the file you intended" >&2
fi

git grep -nE 'AKIA[0-9A-Z]{16}|BEGIN .*PRIVATE KEY|eyJ[A-Za-z0-9_-]+\.' -- \
  ':*.env' ':*.yml' ':*.yaml' ':*.log' ':*.md' || true

# Refuse to hand the live path to an agent file tool.
echo "agent may read: $redacted"
echo "agent must not read: $src"

When a bug needs a token to reproduce, mint a disposable fixture instead of laundering the real one. Replace customer names with stable aliases, then replace account IDs with obviously fake numeric ranges. Keep a small translator on your side of the boundary so you can map the model's advice back. That translator is part of the threat model, because it stops you from pasting the real roster just this once.

# Example policy function. Proposal only, not legal advice and not a control.
def may_send(kind: str, has_prod_ids: bool, has_secrets: bool) -> str:
    if has_secrets:
        return "block: strip credentials or recreate the case with fixtures"
    if kind in {"customer_dump", "hr_export", "medical"}:
        return "block: keep the bytes in room one"
    if kind == "stack_trace" and has_prod_ids:
        return "rewrite: replace hostnames, tokens, and correlation ids"
    if kind in {"unit_test", "public_repro"}:
        return "allow: still run the redactor on the bundle"
    return "review: default deny until a human looks"

Think of that function as a customs officer who cannot be sweet-talked by a clever system prompt. Stack traces can travel after you rewrite identifiers, because the control flow is often the actual question. Customer tables cannot travel, because the model does not need a real person to rearrange a query. Secrets cannot travel even in comments, because comments still sit inside the same request body.

Regex scanners will miss novel secret formats, unicode lookalikes, and screenshots that never become text. A local model still writes swap files, core dumps, and IDE chat databases you might later back up to the cloud. This workflow is a seatbelt, not an airbag, and it will not satisfy a PCI or HIPAA auditor by itself. If you need a real control, you want DLP, a vendor review, and a written data processing agreement.

Do not use this approach as cover for sending production data to a hobby endpoint. Do not use it if your employer already forbids unaudited model providers, because a redactor does not create permission. Do not use it as a substitute for fixtures when the right move is to synthesize a failing test. Teams that already handle export-controlled or classified source should stay on their approved air-gapped path.

If you want a remote place to practice the redacted workflow, MonkeyCode's free model access and free server option are one such room three. Keep the sanitizer in room one, send only the .redacted file, and store the receipt with the ticket. The agent can still help you refactor the code once those secrets have left the brief. That is the whole method: you draw the boundary, then you talk across it on purpose.

The Files You Attach Are Exhibits

Riley Lin — Wed, 16 Sep 2026 04:18:58 +0000

You should treat every file you send a coding model as an exhibit that can outlive the chat. A context window is not a private whiteboard, even when the editor tab still looks like home. The useful response is a local preflight that blocks secrets, internal maps, and live credentials before any request is built.

A coding assistant answers in your project's voice, so it is tempting to brief it like a teammate. It does not join your incident channel, sign your NDA, or rotate a token when a paste goes wrong. You are handing exhibits to a stranger with excellent memory and a disk you do not own. That stranger may be a local process, a vendor runtime, or a free shared server you never inventory.

The threat is not a cinematic jailbreak; it is ordinary oversharing under deadline pressure in a real repository. You attach a supposedly blank example file and accidentally include the neighboring live environment file. You paste a failing test that still embeds a staging JWT inside a fixture header that looks like noise. You drop a stack trace that prints an internal hostname, a customer email, and a bearer token together.

Think of the model session as a deposition room with the recorder already running on the table. Anything you mark as context can be stored, summarized, or replayed under a policy you did not write. You will not receive a reliable inventory of those exhibits after the request has already left. The only inventory that matters is the one you generate locally, with a tool that works offline.

Four rooms, one courier

Draw four rooms before you paste, even if you only draw them in a comment above the prompt. Room one is the workstation and the files that should never leave the disk you still control. Room two is the prompt builder, including editor plugins that pack nearby files you did not actually read. Room three is the model runtime, which may be local, billed, or a free hosted server. Room four is everything that comes back, including the completion, the tool trace, and the client history file.

Secrets jump rooms without asking you, because the courier is helpful and slightly nosy. A plugin that adds nearby files for better context is a courier, not a reviewer with a warrant. A free server that accepts a zip of your tree is a loading dock with someone else's cameras. Your job is to search the courier's bag before it reaches that dock, every time, with a command a teammate can rerun.

Keep the scanner boring on purpose, because clever classifiers fail open when you are tired and late. Regular expressions will not replace a security review, and they will not satisfy a regulator sitting on a real incident. They will catch the embarrassing class of mistakes that still dominate writeups: keys in fixtures, PEM blocks in temporary folders, and Authorization headers in copied curl. Treat every hit as a blocker until a human says the line is actually fiction.

Room	What actually lives there	Default stance before a send
Workstation	Private keys, live `.env`, customer exports	Do not copy into the attach set
Prompt builder	Editor plugins, extra “nearby” files, chat history	Inspect the packed bag, not the tab title
Model runtime	Local process or hosted GPU path you do not audit	Send only synthetic or already scanned exhibits
Return path	Completions, tool traces, local session transcripts	Store encrypted or disable when the repo is sensitive

A preflight you can refuse to skip

Save the following proposal as preflight_context.py and run it against a staging directory that contains only the files you intend to attach. It is unlabeled production code in the sense that you can execute it, but you should still read it before you trust it on a repository you care about. The script prints blockers on stdout and returns exit status two when the bag is still dirty.

#!/usr/bin/env python3
"""Local preflight for files you might send to a coding model.

Proposal: refuse the upload if any rule hits. This is not a compliance program.
"""
from __future__ import annotations

import argparse
import pathlib
import re
import sys

RULES = [
    ("pem_private_key", re.compile(r"-----BEGIN ([A-Z0-9 ]+)?PRIVATE KEY-----")),
    ("aws_access_key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
    ("generic_bearer", re.compile(r"(?i)\bbearer\s+[A-Za-z0-9\-._~+/]+=*")),
    (
        "jwt_like",
        re.compile(
            r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"
        ),
    ),
    (
        "env_assignment",
        re.compile(
            r"(?i)^(api|auth|secret|token|password|private)_?[a-z0-9_]*\s*="
        ),
    ),
    (
        "private_ipv4",
        re.compile(
            r"\b10\.\d{1,3}\.\d{1,3}\.\d{1,3}\b"
            r"|\b192\.168\.\d{1,3}\.\d{1,3}\b"
            r"|\b172\.(1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3}\b"
        ),
    ),
    ("internal_host", re.compile(r"(?i)\b[a-z0-9.-]+\.(internal|corp|lan|local)\b")),
    (
        "email_like",
        re.compile(r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.I),
    ),
]

SKIP_DIRS = {".git", "node_modules", "dist", "build", ".venv", "__pycache__"}
TEXT_SUFFIXES = {
    ".py", ".js", ".ts", ".tsx", ".go", ".rb", ".java", ".env",
    ".yml", ".yaml", ".json", ".md", ".txt", ".toml", ".ini", ".cfg", ".sh",
}

def iter_files(root: pathlib.Path):
    for path in root.rglob("*"):
        if not path.is_file():
            continue
        if any(part in SKIP_DIRS for part in path.parts):
            continue
        if path.suffix.lower() not in TEXT_SUFFIXES and path.name not in {
            ".env",
            "id_rsa",
            "id_ed25519",
        }:
            continue
        yield path

def scan_file(path: pathlib.Path) -> list[tuple[int, str, str]]:
    hits: list[tuple[int, str, str]] = []
    try:
        text = path.read_text(encoding="utf-8", errors="replace")
    except OSError as exc:
        return [(0, "unreadable", str(exc))]
    for lineno, line in enumerate(text.splitlines(), start=1):
        for name, pattern in RULES:
            if pattern.search(line):
                hits.append((lineno, name, line.strip()[:160]))
    return hits

def main() -> int:
    parser = argparse.ArgumentParser(
        description="Refuse model context that still looks like production evidence."
    )
    parser.add_argument("root", type=pathlib.Path)
    parser.add_argument("--allow-email", action="store_true")
    args = parser.parse_args()
    blocked = 0
    for path in iter_files(args.root.resolve()):
        for lineno, name, snippet in scan_file(path):
            if name == "email_like" and args.allow_email:
                continue
            blocked += 1
            print(f"BLOCK {path}:{lineno} [{name}] {snippet}")
    if blocked:
        print(
            f"preflight failed: {blocked} exhibit(s) still in the bag",
            file=sys.stderr,
        )
        return 2
    print("preflight ok: no rule hits in attach set")
    return 0

if __name__ == "__main__":
    raise SystemExit(main())

Run it against a staging folder, not against the whole monorepo on the first pass, because a flood of findings trains you to click through them. Copy only the two or three files that actually exhibit the bug, then let the scanner argue with that smaller bag. If a fixture still holds a live token, replace it with an obviously fake constant before you copy, and scan again until the command is quiet.

mkdir -p /tmp/model-exhibits
cp app/payment_retry.py tests/test_payment_retry.py /tmp/model-exhibits
python3 preflight_context.py /tmp/model-exhibits
echo $?
# Replace a live fixture token, then scan again:
# sed -i 's/eyJ[^"]*/test_token_not_secret/' /tmp/model-exhibits/test_payment_retry.py

When the scanner is quiet, you still read the files once with your own eyes, because customer identifiers hide in comments that no regex author predicted. A string like test_token_not_secret is easier to review than a redacted blob that still looks like a JWT in passing. If the model only needs a shape, give it a shape you would be willing to paste into a public issue tracker.

What must not ride along

Some objects should never enter room three, even after you rename them or call them examples. Production private keys, customer exports, unreleased vulnerability notes, and session cookies are inventory, not context for a completion. If the assistant needs an object graph, you synthesize one with fake names and impossible account numbers. Realism is not a gift you owe a model that cannot take your pager.

Internal architecture can be a secret even when it contains no key material at all. A complete service map, a hostname convention, and a comment about which jump host bypasses MFA will help an attacker more than they help a retry loop. You can describe backoff math without delivering the wiring diagram of the plant that runs it. If a file is useful only because it is real, it is probably too real to attach.

Logs deserve the same suspicion you already apply to copied traces in an incident channel, because logs are just structured pastes with timestamps. A single application line can carry a cookie, a user id, and an internal URL that should never leave room one. If you must show a failure, rebuild a minimal log from fake identifiers and the one stack frame that exhibits the bug. Do not strip a token by eye in a twelve-hundred-line file while the model waits.

The session transcript on your machine is also an exhibit, including the prompt you decided not to send. Clients that keep history will store the dirty draft beside the clean one, often in a JSON file the next plugin will happily reread. Point that history at an encrypted path you control, or disable it when the repository is sensitive. A redaction gate that writes findings to a world-readable log has only moved the secret to a friendlier filename.

When the runtime is free, the bag still is not

Local models shrink room three, but they do not delete plugin packing or the local transcript risk you already have. Hosted models widen room three to a network path you cannot audit with ps and a flashlight. Free model access and a free server make that widening easy to ignore, because no invoice arrives to remind you that packets left the building.

MonkeyCode's free model access and free server option are relevant here only as a concrete hosted setting for the same preflight, not as a substitute for the scanner. Disclosure: This article was prepared as part of MonkeyCode's product outreach. If you use that option, keep preflight_context.py and the exhibit folder on the workstation, and send only a directory that already returned exit status zero. The hosted runtime can still log prompts on its side; your scanner cannot see that log, which is why the bag must be clean before it travels.

A reasonable loop looks like copy, scan, read, send, then delete the exhibit folder so the next paste cannot inherit yesterday's fixtures. You can wrap that loop in a shell function if your team already lives in the terminal and reviews functions like this. You should not wrap it in a browser extension you have not read, because the extension becomes another courier with its own disk.

preflight_send() {
  src="$1"
  stage="$(mktemp -d /tmp/exhibits.XXXXXX)"
  cp -R "$src" "$stage/attach"
  python3 "$HOME/bin/preflight_context.py" "$stage/attach" || {
    rm -rf "$stage"
    echo "refusing to send; scanner blocked the attach set" >&2
    return 2
  }
  echo "attach set staged at $stage/attach"
  echo "send that directory only, then: rm -rf $stage"
}

Limits, and who should not stop here

This workflow will miss secrets that are split across lines, encrypted at rest, or encoded in screenshots and design exports. It will also flag harmless addresses in license headers if you forget --allow-email on a docs folder. Regex preflight is a seatbelt, not an airbag, and it does not create a processing agreement with anyone who runs the model. Green output means no rule hit, not that the file is harmless in a courtroom.

Do not use this approach as your only control if you handle regulated health data, payment card data, or classified government material. Those regimes need contractual terms, approved vendors, and often an air gap, not a volunteer script in /tmp. Do not use a quiet scan to justify pasting a customer database because the completion would be more accurate with the real rows.

Teams that already operate an allowlisted enterprise assistant with DLP in the proxy may find the script redundant at the network edge. Run it anyway on the laptop if the editor plugin can attach files that the proxy never sees as a distinct upload. The plugin is still room two, and room two is where most oversharing starts during a normal afternoon.

The core conclusion does not change when the model gets better at producing patches you would almost merge. Better completions increase the volume of files you are willing to attach, which increases the volume of exhibits you might leak. Keep the preflight on your side of the elevator, even when the stranger on the other side answers for free.

The Context Bundle Is a Customs Declaration

Riley Lin — Mon, 14 Sep 2026 21:50:46 +0000

You cannot audit a model provider, but you can audit what you send it. The weekly argument about whether an assistant writes better code than you do skips the question that actually protects you: which bytes left the machine, in which class, and where that decision was written down. This article builds an egress gate that answers all three for a context bundle, plus a hash-chained ledger you can replay months later, in plain Node with no dependencies.

The declaration belongs to you, not the vendor

A hosted endpoint is a border crossing with a very quiet customs desk. Providers publish terms, subprocessors, and retention windows, and those documents move on their own schedule, so a page you read in March is not evidence about what happens in September. The part of the crossing you actually control is the declaration, which is the set of files and snippets you put into the request. If you cannot name the classes of material inside that bundle, no privacy page will save you.

Free access makes the crossing more frequent rather than safer. When the only cost is a key and a terminal, most of us paste an entire directory on the first afternoon, including the local .env, the terraform.tfstate, and last week's incident notes. MonkeyCode's free model access and free server option both lower that entry cost, and both add an egress path you should classify before you use them in a real workflow.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The public conversation still treats these tools mostly as a capability question, which is why security coverage arrives late. Capability debates are loud because everybody can run a demo, while egress mistakes are quiet because nothing visibly breaks on the day you leak. So build the boring control first, before you have a reason to regret not having it.

Four classes, one action each

The threat model below is the smallest one I have found useful for coding assistants, because every class maps to exactly one action and the gate never has to improvise at runtime.

class	what lands in it	action	what the model receives
`live`	`.env`, `kubeconfig`, cloud keys, private key blocks, unexpired JWTs	deny	nothing at all until the bundle changes
`tenant`	internal hostnames, private IP ranges, account IDs, staging URLs	deny	nothing, unless you rename the values first
`personal`	customer emails, order identifiers, payment-shaped numbers	redact	a placeholder that carries a short digest
`ambient`	`FIXME`, `TODO(security)`, review leftovers	warn	the file as written, with the hit logged

The two deny rows are where reasonable people start arguing, and the argument usually confuses secrecy with sensitivity. An internal hostname is not a secret in the cryptographic sense, yet it is a map of your infrastructure, and maps are how an attacker picks a target. The same logic covers a staging URL and a twelve-digit account ID: individually harmless, collectively a reconnaissance report you mailed out by hand.

The personal row is where redaction earns its place, because blocking it outright would make the workflow useless for anyone touching support tickets. Replacing an address with [personal:9f3c21ab77e041d8] keeps the sentence readable for the model while removing the identifier you cannot unshare. The ambient row exists only so that unresolved security notes show up in your ledger instead of hiding in plain sight.

A policy file you can read in one screen

Keep the rules in data, not in code, so a reviewer can read the policy without reading the gate. Patterns are plain regular expressions, which means they are as good as the list you maintain and no better.

{
  "classes": [
    {
      "id": "live",
      "action": "deny",
      "patterns": [
        "AKIA[0-9A-Z]{16}",
        "-----BEGIN [A-Z ]+PRIVATE KEY-----",
        "ghp_[A-Za-z0-9]{36}",
        "eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}"
      ]
    },
    {
      "id": "tenant",
      "action": "deny",
      "patterns": [
        "[a-z0-9-]+\\.internal\\b",
        "\\b10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\b",
        "arn:aws:[a-z0-9-]+:[a-z0-9-]*:\\d{12}:"
      ]
    },
    {
      "id": "personal",
      "action": "redact",
      "patterns": [
        "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}",
        "\\b\\d{4}[- ]?\\d{4}[- ]?\\d{4}[- ]?\\d{4}\\b"
      ]
    },
    {
      "id": "ambient",
      "action": "warn",
      "patterns": ["TODO\\(security\\)", "FIXME"]
    }
  ]
}

The ordering question that trips people up is overlap, because a JWT inside a log line can match more than one class. Resolve it by severity rather than by file order, which is why the gate below ranks deny above redact above warn. If you would rather have per-file overrides, add them as explicit exclusions instead of loosening a global pattern.

Refuse first, record second

The gate walks the bundle once, classifies every text file, and exits with a distinct status you can use in a shell pipeline. Exit code 0 means the bundle may be sent, 2 means you called it wrong, and 3 means something in the bundle belongs on your machine and nowhere else.

#!/usr/bin/env node
// egress-gate.mjs - classify a context bundle, then seal the decision.
import { readFileSync, writeFileSync, appendFileSync, mkdirSync, readdirSync } from "node:fs";
import { join, dirname, relative } from "node:path";
import { createHash } from "node:crypto";

const argv = process.argv.slice(2);
const flag = (name, fallback = null) => {
  const i = argv.indexOf(name);
  return i === -1 ? fallback : argv[i + 1];
};

const bundle = flag("--bundle");
const policyPath = flag("--policy", "./egress-policy.json");
const ledgerPath = flag("--ledger", "./egress-ledger.jsonl");
const outDir = flag("--out");

if (!bundle) {
  console.error("usage: node egress-gate.mjs --bundle <dir> [--policy f] [--ledger f] [--out f]");
  process.exit(2);
}

const policy = JSON.parse(readFileSync(policyPath, "utf8"));
const classes = policy.classes.map((c) => ({
  ...c,
  compiled: c.patterns.map((p) => new RegExp(p, "g")),
}));

const sha = (value) => createHash("sha256").update(value).digest("hex").slice(0, 16);
const rank = { allow: 0, redact: 1, deny: 2 };

function* walk(dir) {
  for (const entry of readdirSync(dir, { withFileTypes: true })) {
    const path = join(dir, entry.name);
    if (entry.isDirectory()) yield* walk(path);
    else yield path;
  }
}

function classify(text) {
  const hits = [];
  const spans = [];
  for (const cls of classes) {
    for (const rx of cls.compiled) {
      rx.lastIndex = 0;
      let match;
      while ((match = rx.exec(text)) !== null) {
        if (match[0].length === 0) break;
        const digest = sha(match[0]);
        hits.push({ class: cls.id, action: cls.action, bytes: match[0].length, digest });
        if (cls.action !== "warn") {
          spans.push({ start: match.index, end: match.index + match[0].length, label: `${cls.id}:${digest}` });
        }
      }
    }
  }
  let redacted = text;
  for (const span of spans.sort((a, b) => b.start - a.start)) {
    redacted = redacted.slice(0, span.start) + `[${span.label}]` + redacted.slice(span.end);
  }
  return { hits, redacted };
}

let verdict = "allow";
const entries = [];

for (const file of walk(bundle)) {
  const text = readFileSync(file, "utf8");
  if (text.includes("\u0000")) continue; // binary payloads are out of scope, see limitations
  const rel = relative(bundle, file);
  const { hits, redacted } = classify(text);
  for (const hit of hits) {
    entries.push({ file: rel, ...hit });
    if (rank[hit.action] > rank[verdict]) verdict = hit.action;
  }
  if (outDir) {
    const dest = join(outDir, rel);
    mkdirSync(dirname(dest), { recursive: true });
    writeFileSync(dest, redacted);
  }
}

let prev = "genesis";
for (const entry of entries) {
  const chain = sha(prev + JSON.stringify(entry));
  appendFileSync(ledgerPath, JSON.stringify({ ...entry, prev, chain }) + "\n");
  prev = chain;
}

console.log(JSON.stringify({ bundle, verdict, findings: entries.length, ledger: ledgerPath, out: outDir }, null, 2));
process.exit(verdict === "deny" ? 3 : 0);

Two design choices are worth defending. The gate records decisions even when it denies the bundle, because a blocked attempt is exactly the event you want in your history, and it stores only a truncated digest of the matched value instead of the value itself. It also writes the redacted tree while it walks, so treat ./ctx-redacted as scratch output and only point an assistant at it after a clean exit code.

The ledger chains every decision to the last one

Each line carries the previous line's chain value, so removing or editing an entry breaks every line after it. That property is cheap to build and expensive to fake later, which is the whole point of writing the decision down at all.

// verify-ledger.mjs - re-derive the chain from the file itself.
import { readFileSync } from "node:fs";
import { createHash } from "node:crypto";

const sha = (v) => createHash("sha256").update(v).digest("hex").slice(0, 16);
let prev = "genesis";

for (const line of readFileSync(process.argv[2], "utf8").trim().split("\n")) {
  const { prev: recorded, chain, ...entry } = JSON.parse(line);
  const expected = sha(prev + JSON.stringify(entry));
  if (recorded !== prev || chain !== expected) throw new Error(`ledger broken at ${entry.file}`);
  prev = chain;
}

console.log("chain ok:", prev);

Run it with node verify-ledger.mjs ./egress-ledger.jsonl, and keep the output next to the diff that used the bundle. One honest caveat about this technique: the chain depends on canonical key order in JSON.stringify, so renaming a field in the gate invalidates old lines. That fragility is the feature, because it forces you to version the format deliberately instead of rewriting history quietly.

Three fixtures, three verdicts

The tests below build throwaway bundles in a temp directory, run the gate as a subprocess, and assert on both the exit code and the ledger contents. The second assertion in each case matters more than the first, because a classification that still leaks the raw value into the log has made things worse.

import { test } from "node:test";
import assert from "node:assert/strict";
import { execFileSync } from "node:child_process";
import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from "node:fs";
import { tmpdir } from "node:os";
import { join, dirname } from "node:path";

const HERE = dirname(new URL(import.meta.url).pathname);
const GATE = join(HERE, "egress-gate.mjs");
const POLICY = join(HERE, "egress-policy.json");

function sandbox(files) {
  const root = mkdtempSync(join(tmpdir(), "egress-"));
  const bundle = join(root, "ctx");
  for (const [name, body] of Object.entries(files)) {
    const dest = join(bundle, name);
    mkdirSync(dirname(dest), { recursive: true });
    writeFileSync(dest, body);
  }
  return { bundle, ledger: join(root, "ledger.jsonl"), out: join(root, "ctx-redacted") };
}

function gate(args) {
  try {
    return { code: 0, stdout: execFileSync("node", [GATE, ...args], { encoding: "utf8" }) };
  } catch (err) {
    return { code: err.status ?? 1, stdout: err.stdout ?? "" };
  }
}

test("a live credential stops the run before egress", () => {
  const { bundle, ledger } = sandbox({ "src/config.js": "export const key = \"AKIAIOSFODNN7EXAMPLE\";" });
  const { code } = gate(["--bundle", bundle, "--policy", POLICY, "--ledger", ledger]);
  assert.equal(code, 3);
  const written = readFileSync(ledger, "utf8");
  assert.match(written, /"class":"live"/);
  assert.equal(written.includes("AKIAIOSFODNN7EXAMPLE"), false);
});

test("a customer email becomes a digest marker", () => {
  const { bundle, ledger, out } = sandbox({ "docs/report.md": "Contact ops@example.com about the rollout." });
  const { code } = gate(["--bundle", bundle, "--policy", POLICY, "--ledger", ledger, "--out", out]);
  assert.equal(code, 0);
  assert.match(readFileSync(join(out, "docs/report.md"), "utf8"), /\[personal:[0-9a-f]{16}\]/);
  assert.equal(readFileSync(ledger, "utf8").includes("ops@example.com"), false);
});

test("a clean bundle leaves no ledger file at all", () => {
  const { bundle, ledger } = sandbox({ "src/math.ts": "export const add = (a: number, b: number) => a + b;" });
  const { code } = gate(["--bundle", bundle, "--policy", POLICY, "--ledger", ledger]);
  assert.equal(code, 0);
  assert.equal(existsSync(ledger), false);
});

Run the suite with node --test gate.test.mjs, then drive a real bundle from a manifest rather than by copying a working tree, which keeps later commits from silently widening the request:

git ls-files 'src/**/*.ts' 'docs/**/*.md' > ctx-manifest.txt
node egress-gate.mjs --bundle ./ctx --policy ./egress-policy.json \
  --ledger ./egress-ledger.jsonl --out ./ctx-redacted
echo $?

On a bundle holding one leaked key, the gate prints "verdict": "deny" and exits 3, and the ledger holds a line that names the file, the class, and a digest instead of the credential. On a bundle with a single support email, the verdict is redact, the exit code is 0, and only the placeholder survives in ./ctx-redacted.

What this does not cover

A regex gate is a seatbelt, not a roll cage. It only catches formats you wrote down, so a novel token shape, a base64 blob of a config file, or a secret split across two lines will pass with a green exit code. Binary files are skipped by design in the snippet above, which means a database dump, a screenshot, or a binary archive can carry sensitive material straight through your gate without a single finding.

Redaction is also lossy in a way that is easy to underestimate, because structure itself carries information. A redacted schema still reveals your table names, a redacted stack trace still reveals module paths, and a redacted customer ticket still reveals that the feature exists. Nothing here constrains what the provider retains, how long it keeps it, whether a human reviews it, or which subprocessors sit behind the endpoint, so read the current terms yourself instead of trusting a blog post from any month.

Finally, the gate covers egress only, and the response path is a separate problem. A model can echo a real token back into a diff, a chat transcript can end up committed, and a pasted stack trace can be regenerated into a test fixture. Treat returned text as untrusted input, and keep transcripts out of the repository.

Who should not use this

Do not adopt this workflow as a compliance control if you operate under a regime that expects approved data-loss-prevention tooling and documented legal review, because a hand-maintained pattern list will not satisfy an auditor and should not try to. Skip it as well if nobody on the team will own the policy file, since a stale rule set is worse than no rule set, because it hands out confidence you have not earned.

You should also skip it if your job is genuinely to debug production data, because the gate will block you several times a day and you will learn to bypass it. In that case, change the workflow instead of the tool: reproduce the failure against a sanitized fixture you build deliberately, and bring that fixture to the model. If you want to try the whole loop, the free tier is enough to run the fixtures above end to end, and you should check the current allowances yourself before you depend on them, since free limits move faster than articles do.

The Prompt Is an Export License

Riley Lin — Sun, 13 Sep 2026 20:31:50 +0000

Every remote coding prompt is a data export, and you should classify it before it leaves your machine. You would not attach an unreviewed archive to an external ticket, yet many of us paste whole files into a model. The model cannot unsee a secret, and neither can the logs that sit behind that endpoint. Treat the request as a customs form, then decide what is allowed to cross the boundary.

This walkthrough is about that classification step, not a beauty contest among coding assistants. You will run a small local gate that labels regions of a proposed prompt as public, internal, or forbidden. The gate never needs network access, which is the reason it sits in front of any remote call. Convenience on the far side of the wire does not change the label on your side.

You can point the same gate at any remote assistant, including MonkeyCode, after the payload is clean. Disclosure: This article was prepared as part of MonkeyCode's product outreach, and it does not invent lab numbers or model charts. Free model access and a free server option do not move the trust boundary onto your laptop. They only make a remote call cheaper to start, so the export license still has to be issued locally.

Think of the prompt as a shipping manifest with three columns that you fill before anyone else sees the crate. The first column is public material, such as an error string you could post on a forum without naming a tenant. The second column is internal texture, such as a hostname that slowly draws a floor plan for anyone who collects enough samples. The third column is forbidden cargo, such as a bearer token that turns a model provider into an accidental keyholder.

A useful analogy is airport security for source, because the scanner is allowed to be crude if it stands next to you. You are not building a compiler for secrets, and you should not pretend a regex is a clearance program. You are building a pause: a chance to refuse the flight when a private key is sitting in the carry-on. The pause is the control, and the pattern list is only a flashlight you keep on your own desk.

Here is a compact decision matrix you can keep beside that flashlight. Public API shapes, documented status codes, and stack frames with dummy names may leave when they hold no tenant data. Internal hostnames, RFC1918 addresses, and work emails should become stable placeholders so a transcript cannot be stitched into a network map. Forbidden items include private keys, cloud access keys, connection strings, raw Authorization headers, and any credential that was live even inside a test fixture. When a file mixes those classes, you split the file; you do not average the risk and hope the model is polite.

Class	Typical region	Crosses the wire?	Gate action
public	documented errors, public types	yes	copy through
internal	private DNS, RFC1918, work email	only as a placeholder	substitute
forbidden	keys, bearer headers, database URIs	no	drop the line and fail

Before you run the gate, stage a tiny folder that contains only the files you intended to quote. Copy them into /tmp/export-src so the scanner cannot wander into your home directory by accident. Drop a decoy secret in one file so you can see a forbidden hit on purpose. The decoy tests the gate, not the model, and it must never be a real key from a living environment.

mkdir -p /tmp/export-src
cat > /tmp/export-src/app.py << 'EOF'
# public: a handler you might show in a gist
def health():
    return {"ok": True}

# internal texture that maps a floor
DB_HOST = "payments.prod.internal"
DB_ADDR = "10.4.12.9"

# forbidden cargo, AWS documented example key only
AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"
AUTH = "Authorization: Bearer eyJhbGciOiFAKE"
EOF

cat > /tmp/export-src/errors.md << 'EOF'
Timeout talking to https://api.example.com/v1/health
Contact jane.doe@example.com if this is a drill.
EOF

Save the gate as prompt_export_gate.py and keep it offline. It reads named files, writes a redacted bundle, and writes a receipt that stores line digests instead of the secret text. Directories are refused on purpose, because a recursive walk is how a helpful tool becomes an export of the whole tree.

#!/usr/bin/env python3
"""Local export gate for coding-assistant prompts. No network I/O."""
from __future__ import annotations

import argparse
import hashlib
import json
import re
import sys
from dataclasses import asdict, dataclass
from pathlib import Path

RULES = [
    ("forbidden", "pem_block", re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----")),
    ("forbidden", "aws_access_key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
    ("forbidden", "generic_bearer", re.compile(r"(?i)\b(authorization:\s*bearer|x-api-key)\s+\S+")),
    ("forbidden", "named_secret", re.compile(r"(?i)\b(aws_secret_access_key|private_key|client_secret)\s*[:=]\s*\S+")),
    ("forbidden", "db_uri", re.compile(r"(?i)\b(postgres|mysql|mongodb(\+srv)?)://[^\s]+")),
    ("internal", "rfc1918", re.compile(
        r"\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|"
        r"172\.(?:1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3})\b"
    )),
    ("internal", "hostname_local", re.compile(r"\b(?:[a-z0-9-]+\.)+(?:internal|local|corp|lan)\b", re.I)),
    ("internal", "email", re.compile(r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.I)),
]

@dataclass
class Finding:
    path: str
    line_no: int
    cls: str
    label: str
    digest: str

def line_digest(text: str) -> str:
    return hashlib.sha256(text.encode("utf-8", errors="replace")).hexdigest()[:12]

def classify_line(line: str) -> list[tuple[str, str]]:
    return [(cls, label) for cls, label, rx in RULES if rx.search(line)]

def scan_path(path: Path) -> tuple[str, list[Finding]]:
    findings: list[Finding] = []
    try:
        text = path.read_text(encoding="utf-8", errors="replace")
    except OSError as exc:
        return f"# skip {path}: {exc}\n", findings

    out_lines: list[str] = []
    for i, line in enumerate(text.splitlines(), start=1):
        hits = classify_line(line)
        if any(cls == "forbidden" for cls, _ in hits):
            labels = ",".join(label for _, label in hits)
            findings.append(Finding(str(path), i, "forbidden", labels, line_digest(line)))
            out_lines.append(f"[REDACTED:{labels}]")
            continue
        redacted = line
        if hits:
            labels = ",".join(label for _, label in hits)
            findings.append(Finding(str(path), i, "internal", labels, line_digest(line)))
            for cls, label, rx in RULES:
                if cls == "internal":
                    redacted = rx.sub(f"[REDACTED:{label}]", redacted)
        out_lines.append(redacted)
    return f"\n# --- {path} ---\n" + "\n".join(out_lines) + "\n", findings

def main() -> int:
    parser = argparse.ArgumentParser(description="Classify a prompt export locally.")
    parser.add_argument("paths", nargs="+", type=Path)
    parser.add_argument("--receipt", type=Path, default=Path("export-receipt.json"))
    parser.add_argument("--bundle", type=Path, default=Path("export-bundle.txt"))
    parser.add_argument("--fail-on", choices=["forbidden", "internal"], default="forbidden")
    args = parser.parse_args()

    bundle: list[str] = []
    findings: list[Finding] = []
    for path in args.paths:
        if path.is_dir():
            print(f"refuse directory: {path}", file=sys.stderr)
            return 2
        chunk, found = scan_path(path)
        bundle.append(chunk)
        findings.extend(found)

    args.bundle.write_text("".join(bundle), encoding="utf-8")
    receipt = {
        "files": [str(path) for path in args.paths],
        "findings": [asdict(item) for item in findings],
        "forbidden": sum(1 for item in findings if item.cls == "forbidden"),
        "internal": sum(1 for item in findings if item.cls == "internal"),
    }
    args.receipt.write_text(json.dumps(receipt, indent=2), encoding="utf-8")
    print(f"wrote {args.bundle} and {args.receipt}")

    blocked = receipt["forbidden"]
    if args.fail_on == "internal":
        blocked = blocked or receipt["internal"]
    if blocked:
        print("export blocked: classified regions still present", file=sys.stderr)
        return 2
    return 0

if __name__ == "__main__":
    raise SystemExit(main())

Run it against the staged files and read the exit code before you open a chat box. A non-zero status means you do not paste, even if the bundle looks readable at a glance. The receipt is the license stub, and the bundle is only cargo that survived the scanner.

python3 prompt_export_gate.py /tmp/export-src/app.py /tmp/export-src/errors.md \
  --bundle /tmp/export-bundle.txt \
  --receipt /tmp/export-receipt.json \
  --fail-on forbidden
echo "gate_status=$?"
python3 - << 'PY'
import json
from pathlib import Path
receipt = json.loads(Path("/tmp/export-receipt.json").read_text())
print("forbidden", receipt["forbidden"], "internal", receipt["internal"])
for row in receipt["findings"]:
    print(row["cls"], row["label"], row["path"], "line", row["line_no"], "digest", row["digest"])
print(Path("/tmp/export-bundle.txt").read_text())
PY

The receipt stores a digest of the line, not the line itself, because an audit log that reprints the password is just another envelope. You keep classes, paths, and line numbers so you can find the problem in the original tree. You do not keep a second copy of the secret in JSON next to the redacted bundle. If the receipt and the bundle ever disagree, you trust the refusal and you still do not paste.

You should also watch comments, because comments are where tickets, customer names, and reset links like to hide. A block that looks like documentation can still name a hostname that only exists on your side of the firewall. If you need the model to reason about control flow, you can keep the structure and replace the nouns. If you need the model to reason about a leaked key, you should rotate the key in your own systems instead of mailing it to a model for advice.

Logs deserve the same license, including the ones your editor writes while you think you are only chatting. Tool output, debug panes, and crash text often reconstruct environment variables that never appeared in the file you meant to share. If your assistant wraps a local command, you classify that stdout with the same gate before it becomes context. A free remote runtime does not make those bytes less sensitive; it only adds one more place they can rest.

This approach has sharp limits, and you should treat them as part of the method rather than fine print. Regular expressions will miss secrets that are split across lines, stored in images, or encoded in ways the flashlight does not know. They will also false-flag public sample keys, which is annoying and still cheaper than shipping a real one. The gate does not encrypt anything, does not negotiate a contract with a vendor, and does not prove that a provider will delete transcripts on your schedule.

You should not use this workflow as a substitute for a real data-loss program when you handle payment data, health records, or government material. You should not use it to launder a dump of production traffic into a prompt by redacting only the obvious header. You should not use it if your threat model includes an attacker on your laptop, because the original files remain on disk in the clear. In those cases you need isolation, retention rules, and people with authority, not a Python file in /tmp.

Used honestly, the gate gives you a repeatable pause between curiosity and transmission. You classify the crate, you keep a receipt that cannot replay the secret, and you only then decide whether a remote model is allowed to see the remainder. If you already reach for MonkeyCode's free model access or free server option, run this license step on the working files first and keep the receipt with your session notes.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The Repro Packet Is a Keyring

Riley Lin — Sat, 12 Sep 2026 18:32:33 +0000

When an HTTP client fails in staging, you usually paste the request into a coding model for a second reading. The status code, the path, and the timing of that request are the parts that explain the failure. The Authorization header, the session cookie, and any signed query parameter do not explain the failure at all. They only copy a live credential into a context window that you do not operate or retain.

You already refuse to drop production passwords into a casual chat, and that instinct is correct. Debug paste is still the path where those same secrets leave the laptop in practice. A copied curl from DevTools, a HAR export, or a CI log that looks truncated can still carry hostnames and bearer tokens. Once that packet reaches a remote model or a remote execution host, the credential is no longer a local note.

Treat every repro packet as a keyring that happens to include a stack trace, not as a sanitized story about a bug. The model needs the shape of the request, the status, and the server's error body after tokens are gone. It does not need to impersonate you against the same origin you just failed to call. If a field would let a stranger finish the request, that field stays on your side of the cable.

Here is a typical paste that looks like documentation and behaves like a session dump. Developers copy it because the command is the fastest way to show what they ran. Notice how little of the interesting failure lives in the secret material. The 403 is in routing and policy, not in the bearer string.

curl -sS -D - -o /tmp/body.txt \
  'https://billing.internal.example/v2/invoices?range=2026-09-01' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.example' \
  -H 'Cookie: session=s3cret.flag; csrf=abc' \
  -H 'X-Request-Id: 6f1c2e8a-9b44-4c21-a11e-0d33b7c91aa2' \
  -H 'Content-Type: application/json'

The hostname tells you the service, and the path tells you which resource the client actually hit. The request id tells you which line to find in logs you already control on your side. The bearer token and the session cookie tell a remote model how to become you during that same call. Keep the first three, drop the last two, and you still have a repro the model can reason about.

A small classifier makes that split explicit so you do not rely on late-night judgment during an incident. Save the script next to your notes and run it on any curl command you are about to paste. It is not a security product; it is a labeled preflight that fails closed on headers it does not recognize. Unknown headers join the hold set because novelty is how new auth schemes arrive in ordinary traces.

#!/usr/bin/env python3
"""Classify curl -H lines before they enter a remote prompt. Label, do not guess."""
from __future__ import annotations

import re
import sys

SEND = {
    "accept",
    "accept-language",
    "content-type",
    "if-none-match",
    "user-agent",
    "x-request-id",
    "x-correlation-id",
}
HOLD = {
    "authorization",
    "proxy-authorization",
    "cookie",
    "set-cookie",
    "x-api-key",
    "x-amz-security-token",
}

HEADER_RE = re.compile(r"^-H\s+['\"]?([^:'\"]+)\s*:\s*(.*?)['\"]?$")

def classify(line: str) -> tuple[str, str, str]:
    raw = line.strip().rstrip("\\").strip()
    match = HEADER_RE.match(raw)
    if not match:
        return ("unknown", "", raw)
    name, value = match.group(1).lower(), match.group(2)
    if name in HOLD or name.startswith("x-api-"):
        return ("hold", name, "<redacted>")
    if name in SEND:
        return ("send", name, value)
    return ("hold", name, "<redacted-unlisted>")

def main() -> None:
    for line in sys.stdin:
        if "-H" not in line:
            sys.stdout.write(line)
            continue
        verdict, name, shown = classify(line)
        if verdict == "send":
            sys.stdout.write(f"-H '{name}: {shown}'\n")
        else:
            sys.stderr.write(f"# HOLD {name or 'unparsed'}: do not paste\n")

if __name__ == "__main__":
    main()

Run it as a filter against the command you copied from the ticket or the chat thread. Anything written to standard error is a field that does not belong in the remote prompt. Standard output is the only text you should consider sending across a model or tool boundary. If the filter holds a header you believe is harmless, describe that header in prose instead of restoring it.

python3 classify_curl_headers.py < repro.curl > scrubbed.curl 2> hold.notes
cat hold.notes   # read this; do not paste it
cat scrubbed.curl

That split is the threat model, and it does not depend on which vendor owns the remote hop. Your editor is a trusted zone because you can delete a buffer and watch the bytes leave disk. A remote model is an untrusted zone because the prompt becomes provider-side input without your retention controls. A remote execution server is a second untrusted zone, because tool arguments, retries, and stdout can echo the same header.

Logs and search indexes around those systems are a third copy of whatever you thought you removed. Saying you already deleted the token from the file is not the same as saying it never crossed. Retries are especially noisy, because a failed tool call often reprints its arguments into the next prompt. If you must retry, retry the scrubbed packet, not the original shell history sitting in your scrollback.

If you use MonkeyCode here, treat free model access and the free server option as untrusted zones rather than a local scratchpad. Disclosure: This article was prepared as part of MonkeyCode's product outreach, which is the only reason the product appears in this walkthrough. A free remote hop is easy to click and easy to confuse with an offline review of the same failing request. Classify the repro on your laptop first, then paste only the send set if you still want a free remote reading.

When the model can call tools, the allowlist on the tool name is not a filter on the argument. You may permit an HTTP helper because fetching a public status page seems harmless during a late debug session. The model will fill that argument from whatever still sits in the conversation, including a bearer token pasted five messages earlier. An allowlisted tool with an unbounded argument is a side channel that looks like ordinary productivity.

A Kubernetes event dump has the same shape as that copied curl command from the browser. The describe output prints image names and restart counts that a remote model can actually use during diagnosis. It also prints environment variables that your manifest still injects as plaintext, plus volume paths that map toward cloud credentials. If you need help with CrashLoopBackOff, send the probe configuration and the last event reason rather than a complete describe that smuggles keys.

HAR files are worse than curl because they look like performance documents while storing request and response cookies together. Exporting one from the Network panel is a reasonable local habit when you are chasing a redirect loop. Uploading that file into a prompt is not a performance review; it is a bulk transfer of every header the browser sent. Extract timings and status codes locally, then type the sequence of paths in your own words for the model.

Keep a decision table beside the classifier so the team argues about fields once, not during an outage. Send fields that describe protocol shape, and hold fields that authenticate, authorize, or identify a person. When a field is both diagnostic and identifying, hold it and describe the meaning in your own words. The table is a policy you can diff in git, which is more durable than a memory of last week's close call.

Artifact field	Role in the bug	Cross the remote hop?
Authorization, Cookie, x-api-key	Proves identity	No, never
Signed query (`X-Amz-Signature`, `token=`)	Proves identity	No, rewrite the URL
X-Request-Id, correlation id	Finds local logs	Yes, after you confirm it is not a session
Host + path + status	Locates the failure	Yes
Response body with PII	Explains business logic	No, replace with a fixture
Env from `docker inspect`	Configures the process	No, summarize the missing key name only

This classifier will miss tokens that sit in JSON bodies, basic auth inside the URL, and cookies stuffed into query strings. It will also miss MCP binary attachments and screenshots of the same header bar from a phone camera. Regex over curl is a seatbelt, not a vault, and you should not treat a quiet run as proof the prompt is clean. If your threat model forbids any off-machine analysis, skip remote models entirely and keep the trace in an internal ticket.

People handling payment credentials, medical identifiers, or workplace identity cookies should not paste traces into any remote model. The workflow above is for staging bugs where the useful signal is routing, and where you can replace bodies with fixtures. It is the wrong workflow for incident response on a live tenant, because speed will talk you into sending the hold set. It is also wrong if your company already provides an isolated review environment with a retention policy you actually trust.

If you want a remote second reading, give the model a scrubbed curl and a fake body that still returns the same status. Keep the real keyring in local history where a revoke is still possible after you notice a bad paste. A remote hop can wait until the hold set is empty, even when the model and the server happen to be free. The bug usually lives in routing or serialization, and the credential is almost never the missing clue you needed.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

Replay Fixtures Are Still Live Traffic

Riley Lin — Fri, 11 Sep 2026 16:05:46 +0000

The core conclusion is simple enough to keep on a note beside your editor while you debug. When you attach a recorded HTTP cassette to a remote coding model, you are not sending dummy data. The same is true for a HAR export or a snapshot of a failing request. You are sending a compact copy of production-shaped traffic, complete with cookies, bearer tokens, and internal hostnames.

Most teams treat fixtures as theatrical props because they live under test directories and look boring in review. That folder is closer to a flight recorder than a costume trunk, and the remote model cannot tell the difference. You already learned not to paste database passwords, and you already keep dotenv files off the prompt. Replay files are the remaining envelope that still leaves the building with the original letter inside.

A useful analogy is the security-camera recorder sitting in a closed shop after the staff have gone home. You would not email last night's tape to a stranger just to ask why the door sensor false-triggered. That tape also shows customer faces, badge numbers, and the person who typed at the keypad. A VCR cassette, a Playwright trace, or a saved HAR file is that tape for your API.

The boundary sits at the socket

Draw the trust boundary at the network socket that carries the prompt, not at gitignore and not at the chat UI. Everything assembled into the request body has already left your process and entered another administrative domain. That includes the snippet you highlighted, the buffer an agent indexed, and the fixture a test runner dumped after a red build.

You should name three observers before anything leaves the machine that you actually control today. The first is your laptop, which you mostly trust because you can pull the power cord. The second is the inference host, which you should treat as a curious intern with a perfect memory for this session. The third is anyone who later obtains logs, support dumps, or cached prompts from that host.

Free remote endpoints do not redraw that picture; they only make the second and third observers easier to ignore during a late debugging session. Secrets in this model are not limited to cloud access keys that sit in environment files. A session cookie, a pagination cursor that embeds a user id, and a signed upload URL are secrets of different grades. Logs make the problem worse, because CI prints headers when a test fails and you paste the job output to explain a 401.

One ordinary bad paste

Imagine a checkout test that failed on staging after you merged a routine dependency bump. You copy the GitHub Actions log, a YAML cassette under fixtures, and a Playwright trace you unpacked because the screenshot looked wrong. The log contains a bearer token because someone left HTTP debug enabled on the client library. The cassette repeats that same header on every recorded call toward an internal payments hostname.

None of those files looks like a dotenv file, so scanners that only hunt environment variables stay quiet. The remote model then proposes a retry helper and, trying to be useful, inlines the bearer token inside a comment. You have now copied a live credential into a transcript whose retention you do not set. That is the failure this walkthrough is meant to interrupt before it becomes a rotation ticket.

Inventory the working set

Treat every outbound prompt as a document with attachments, then inventory those attachments on disk before the socket opens. The script below is a local preflight, not a vendor product and not a promise of complete coverage. It walks a directory, reads common replay formats as text, and prints why a given file should stay off the wire.

#!/usr/bin/env python3
"""Local preflight: find replay-shaped files that look unsafe to send to a model."""
from __future__ import annotations

import argparse
import json
import re
import sys
from pathlib import Path

HEADER_RE = re.compile(
    r"(?i)(authorization|cookie|set-cookie|x-api-key|x-amz-security-token)\s*[:=]\s*\S+"
)
JWT_RE = re.compile(
    r"eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}"
)
EMAIL_RE = re.compile(r"[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}")
SUFFIXES = {".har", ".yml", ".yaml", ".json", ".snap", ".txt", ".log"}


def looks_like_replay(path: Path, text: str) -> str | None:
    name = path.name.lower()
    head = text[:2000]
    if name.endswith(".har") or ('"entries"' in head and '"request"' in head):
        return "har-log"
    if "interactions:" in text or "recorded_with:" in text:
        return "vcr-cassette"
    if "nock(" in text or "scope.filteringPath" in text:
        return "nock-fixture"
    if name.endswith(".snap") and ("Authorization" in text or "Set-Cookie" in text):
        return "snapshot-headers"
    if "playwright" in head.lower() and "cookies" in text.lower():
        return "playwright-trace-text"
    return None


def findings(text: str) -> list[str]:
    hits: list[str] = []
    if HEADER_RE.search(text):
        hits.append("auth-or-cookie-header")
    if JWT_RE.search(text):
        hits.append("jwt-shaped-token")
    if EMAIL_RE.search(text):
        hits.append("email-address")
    if "internal." in text or ".svc." in text:
        hits.append("internal-hostname")
    return hits


def main() -> int:
    parser = argparse.ArgumentParser(description="Inventory replay files before they leave the machine.")
    parser.add_argument("root", type=Path, nargs="?", default=Path("."))
    parser.add_argument("--max-bytes", type=int, default=2_000_000)
    args = parser.parse_args()
    rows = []
    for path in args.root.rglob("*"):
        if not path.is_file():
            continue
        cassette_name = "cassette" in path.name.lower()
        if path.suffix.lower() not in SUFFIXES and not cassette_name:
            continue
        try:
            text = path.read_bytes()[: args.max_bytes].decode("utf-8", errors="replace")
        except OSError as exc:
            print(f"# skip {path}: {exc}", file=sys.stderr)
            continue
        kind = looks_like_replay(path, text)
        if not kind:
            continue
        hits = findings(text)
        if hits:
            rows.append(
                {
                    "path": str(path),
                    "kind": kind,
                    "hits": hits,
                    "bytes": path.stat().st_size,
                }
            )
    json.dump(rows, sys.stdout, indent=2)
    print()
    return 1 if rows else 0


if __name__ == "__main__":
    raise SystemExit(main())

Save that file as preflight_replays.py and point it at the directory you were about to drop into the assistant. The JSON document it prints is the threat model in miniature: path, kind, hit classes, and size. You want those names in front of your eyes before a remote model ever sees the bytes.

python3 preflight_replays.py ./tests | tee /tmp/replay-inventory.json
if [ -s /tmp/replay-inventory.json ] && grep -q '"path"' /tmp/replay-inventory.json; then
  echo "strip or withhold the paths in /tmp/replay-inventory.json"
else
  echo "no text replay hits; still withhold binary traces"
fi

Labeled example of a hit you should take seriously, not an observation from a private repo:

[
  {
    "path": "tests/fixtures/checkout.yml",
    "kind": "vcr-cassette",
    "hits": ["auth-or-cookie-header", "jwt-shaped-token"],
    "bytes": 18422
  }
]

The command writes an inventory instead of rewriting fixtures in place, because silent mutation will break tests and hide the lesson you need. Look at the paths, then decide whether a sanitized excerpt is enough for the model to reason about status codes. If the inventory is empty, you still may have binary traces the decoder never opened, so do not treat silence as a blessing.

Here is a blunt sanitizer for a YAML cassette after you have copied a backup out of the repository tree. It is not cryptography, and it will not notice tokens hiding in base64 response bodies. Use it to produce an attachment, not to create a false sense that the original file became safe.

#!/usr/bin/env python3
from pathlib import Path
import re
import sys

REPLACERS = [
    (re.compile(r"(?i)(authorization:\s*)\S+"), r"\1REDACTED"),
    (re.compile(r"(?i)(cookie:\s*)\S+"), r"\1REDACTED"),
    (re.compile(r"(?i)(set-cookie:\s*)\S+"), r"\1REDACTED"),
    (re.compile(r"eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+"), "REDACTED_JWT"),
]


def main() -> None:
    src = Path(sys.argv[1])
    dst = Path(sys.argv[2])
    text = src.read_text(encoding="utf-8", errors="replace")
    for pattern, repl in REPLACERS:
        text = pattern.sub(repl, text)
    dst.write_text(text, encoding="utf-8")


if __name__ == "__main__":
    main()

cp tests/fixtures/checkout.yml /tmp/checkout.yml.bak
python3 redact_cassette.py tests/fixtures/checkout.yml /tmp/checkout.redacted.yml
# attach only /tmp/checkout.redacted.yml — keep the backup off the prompt

If the file contains a recorded body from billing, identity, or messaging, you should not send the file at all. Write the status code and the field names in your own words, which is usually enough for a coding model to discuss control flow. If the file is a HAR from a browser network panel, assume it holds first-party cookies even when you wanted only the error payload. If the file is a snapshot that embeds headers, regenerate it with header stripping in the test helper, then consider the stripped copy.

When the model only needs to know that a retry happened twice, type that sentence and stop attaching evidence. You do not need a full cassette to teach exponential backoff or a simple timeout constant. When you need schema help, copy keys from one object and replace every value with an obviously fake string. The extra minute of typing is cheaper than rotating every token that would have ridden along.

Remote free inference stays on the far side

Some coding assistants let you iterate on free model access and a free server while you clean a fixture. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers that free model access and a free server, and the convenience does not move the trust boundary back onto your laptop.

You still assemble the working set locally, run the inventory, and only then allow a redacted snippet to cross the network. The free server is a different administrative domain, with disks, operators, and retention you do not configure. Treat it like a shared CI runner you do not own: handy for iteration, and not a private notebook. If you already experiment with that setup, send the redacted cassette, never the original trace archive, and never the CI log that printed the bearer token.

CI logs captured with verbose HTTP clients belong on the runner until you strip them by hand. Browser traces and HAR files from staging hosts are worse when a parent domain shares cookies with production. Snapshot files that include Set-Cookie headers or signed query strings are recordings, even if the test name sounds abstract. Compose dumps and Kubernetes describe output often list pull secrets and internal DNS names you should keep local.

Helpful extras from an agent can leak as well, including recent file lists and absolute paths that contain your laptop username. Git remotes with embedded credentials and crash notes that reprint environment variables belong in the same bucket. Your job is to decide the minimum sentence that states the failure, then stop loading exhibits onto the prompt. Descriptions of a failure can travel; recordings of a failure should stay on the machine that made them.

Limitations, and who should skip this

The script is a text heuristic, so binary Playwright traces, encrypted HAR files, and protobuf recordings will slip past it. It will also flag internal hostnames in public dummy cassettes, which is noisy if you already manufacture fake traffic. It does not consult git, so a file you committed last year is still a prompt leak the moment you attach it. Publication in a repository and transmission to a model remain separate events with separate audiences.

Do not promote this preflight into a compliance program or a substitute for a real contract review. If you handle regulated health or payment data, you need counsel on any remote inference, including free endpoints. Do not treat a quiet scanner as permission to paste more customer narrative from a JSON body. A customer story inside a response body can be sensitive without matching a JWT pattern. Teams that already forbid outbound source should keep that ban and ignore the rest of this workflow.

The habit you want is small enough to survive a bad afternoon in a failing pipeline. Before the prompt leaves, ask whether each attached file is a description of a failure or a recording of one. Descriptions of the failure can travel across the socket without taking live credentials along with them. Actual recordings of the same failure should remain on your side of that trust boundary.

Tool Stdout Is a Secret Envelope

Riley Lin — Wed, 09 Sep 2026 16:21:01 +0000

When you wire a coding assistant to your shell, the dangerous payload is rarely the prompt you typed. Secrets ride out in command output, test logs, and stack traces that tools dump without asking. You should treat every tool result as untrusted data that must cross a redaction gate before it reaches a remote model. That gate is a local program you control, not a hopeful instruction buried in a system prompt.

Picture the coding assistant as a contractor who stands just outside your office glass all afternoon. You can hand papers through a slot, yet you cannot unsay anything once the page leaves the room. Remote inference works the same way, because the model and any request store sit beyond your process boundary. A free server does not change that geometry; it only makes the slot easier to use during ordinary weekday work.

The threat model stays small if you draw it on one page and refuse to romanticize agents. Your laptop still holds secrets, customer fixtures, and deployment wiring that must never travel with a prompt. The remote model is an untrusted peer that may train on nothing and still keep logs you never see. Between those two rooms sits the agent loop, which will happily cat a file because a stack trace named its path.

You already know not to paste a production env file into a chat box like a tourist. The quieter failure is docker compose config, kubectl describe, env, and a failing test that prints a signed URL. Those commands are useful, so you run them, and the tool layer forwards the stdout as if it were just another comment. The model then helps by quoting the secret back, which copies it into yet another persisted log line.

If you practice this workflow against a remote coding assistant, keep the product in its place as a convenience, not as a vault. MonkeyCode offers free model access and a free server option that can host that loop while you iterate on local gates. Disclosure: This article was prepared as part of MonkeyCode's product outreach, stated here before any workflow advice continues. The disclosure does not change the boundary, because the server still sits outside your laptop, so redaction stays local.

Draw four boundaries even if your diagram looks boring on a whiteboard in a quiet hallway. One boundary is the agent process versus the files it can open without extra confirmation from you. Another is the network cable, where a completion request leaves and you lose practical recall of the bytes. Persistence and people complete the map, because transcripts and operators may outlive the debugging session you meant to keep brief.

Secrets are not only API keys sitting in a file named env, though that file remains a classic mistake. They also hide in PEM blocks, bearer headers, database URLs, session cookies, and cloud credential process exports. Customer fixtures can be worse, because a unique email in a failing test can identify a real person. You should assume any string that grants access or names a private person is ineligible for the model.

Hope is not a control, so you want a local gate that fails closed when it sees a high risk pattern. The script below is a proposed filter you run on your machine before any tool stdout is attached to a request. It refuses known credential shapes and sensitive path names, then writes a sanitized bundle or exits with an error. Treat it as a seatbelt rather than a vault door, because regular expressions miss encodings and novel token formats.

Fail closed on the laptop

#!/usr/bin/env python3
"""Proposed local preflight gate for assistant context. Run this on your machine."""
from __future__ import annotations

import argparse
import re
import sys
from pathlib import Path

DENY_NAME_PARTS = (
    '.env',
    'id_rsa',
    'id_ed25519',
    'credentials',
    'kubeconfig',
    'serviceaccount',
    '.pem',
    '.p12',
    'terraform.tfstate',
)

PATTERNS = (
    ('aws_access_key', re.compile(r'AKIA[0-9A-Z]{16}')),
    ('pem_block', re.compile(r'-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----')),
    ('bearer', re.compile(r'(?i)bearer\s+[A-Za-z0-9._\-]+=*')),
    ('jwt', re.compile(r'eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}')),
    ('db_url', re.compile(r'(?i)(?:postgres|mysql|mongodb|redis)://[^\s]+')),
    ('generic_secret_assign', re.compile(r'(?i)(api[_-]?key|secret|password|token)\s*[:=]\s*\S+')),
)

PLACEHOLDER = '[REDACTED:{label}]'


def path_denied(path: Path) -> str | None:
    lowered = str(path).lower()
    for part in DENY_NAME_PARTS:
        if part in lowered:
            return part
    return None


def scan_text(text: str) -> list[str]:
    hits = []
    for label, cre in PATTERNS:
        if cre.search(text):
            hits.append(label)
    return hits


def redact_text(text: str) -> str:
    out = text
    for label, cre in PATTERNS:
        out = cre.sub(PLACEHOLDER.format(label=label), out)
    return out


def main() -> int:
    parser = argparse.ArgumentParser(description='Fail closed on secret-shaped context.')
    parser.add_argument('paths', nargs='*', type=Path)
    parser.add_argument('--stdin', action='store_true')
    parser.add_argument('--redact', action='store_true', help='Print redacted text instead of refusing.')
    parser.add_argument('--max-bytes', type=int, default=200000)
    args = parser.parse_args()

    chunks: list[tuple[str, str]] = []
    if args.stdin or not args.paths:
        data = sys.stdin.read(args.max_bytes + 1)
        if len(data) > args.max_bytes:
            print('gate: stdin exceeds max-bytes', file=sys.stderr)
            return 2
        chunks.append(('<stdin>', data))

    for path in args.paths:
        if not path.exists():
            print(f'gate: missing path {path}', file=sys.stderr)
            return 2
        denied = path_denied(path)
        if denied:
            print(f'gate: refuse path {path} (matched {denied})', file=sys.stderr)
            return 2
        data = path.read_text(encoding='utf-8', errors='replace')
        if len(data.encode('utf-8')) > args.max_bytes:
            print(f'gate: {path} exceeds max-bytes', file=sys.stderr)
            return 2
        chunks.append((str(path), data))

    failed = False
    for name, text in chunks:
        hits = scan_text(text)
        if not hits:
            if args.redact:
                sys.stdout.write(text)
            continue
        failed = True
        print(f'gate: {name} hit {",".join(hits)}', file=sys.stderr)
        if args.redact:
            sys.stdout.write(redact_text(text))
    if failed and not args.redact:
        return 2
    return 0


if __name__ == '__main__':
    raise SystemExit(main())

You can wrap a noisy command so the raw bytes never reach the clipboard or the assistant tool channel. The shell function below runs the command, stores stdout in a temp file, and only prints the gated result. If the gate exits nonzero, you keep the original output local and send a short note that redaction refused the payload. That refusal is the success case, not an inconvenience, because a blocked secret never becomes a completion prompt.

A wrapper the agent cannot skip

# Proposed wrapper. Keep raw output out of the assistant tool path.
gate_run() {
  raw="$(mktemp "${TMPDIR:-/tmp}/gate.XXXXXX")"
  if ! "$@" >"$raw" 2>&1; then
    echo "gate_run: command failed; output kept in $raw" >&2
  fi
  if python3 gate_context.py --stdin <"$raw"; then
    cat "$raw"
    rm -f "$raw"
    return 0
  fi
  echo "gate_run: refused to forward stdout; inspect $raw locally" >&2
  return 2
}

# Synthetic checks only. Do not pipe live production secrets into a model to "see what happens".
# gate_run printf 'token=not-a-real-secret\n'
# printf '-----BEGIN PRIVATE KEY-----\nMIIFAKE\n' | python3 gate_context.py --stdin; echo exit:$?

Run the same gate against files the agent wants to attach, not only against live command output from your terminal. A typical preflight looks like listing candidate paths, grepping for secret-looking names, and then handing survivors to the filter. You should still read the sanitized bundle, because a false negative looks like ordinary application text until someone replays the log. Keep the original transcript in a local directory that your assistant allowlist cannot read, and rotate it like any other secret store.

# Proposed name scan, then content scan. Do not point this at production secret stores.
find . -type f \( -name '.env*' -o -name '*credential*' -o -name 'id_rsa*' \) -print
python3 gate_context.py app.log testdata/sample_trace.txt

Agentic loops make this worse because the model can request another tool call after you thought the context was clean. If the error message still contains a relative path, the next call may open the unsanitized file and skip your wrapper. You close that hole by making the only legal tool a wrapper that always runs the gate, never a raw cat. Think of it as a mail room: every envelope goes through the scanner, including replies that look like innocent follow-up questions.

A proposed local test is enough to catch regressions when you add a new secret pattern next month. Put a fake AWS-style token and a tiny PEM block in a fixture file that never leaves your repository's testdata folder. Assert that the gate exits nonzero on the raw fixture and exits zero after you replace those blocks with placeholders. Label this unexecuted until you run it; the value is the habit of testing the control, not a published benchmark.

# proposed_test_gate.py — unexecuted proposal, not a measured result
from pathlib import Path
import subprocess
import sys


def test_refuses_pem_and_akia(tmp_path: Path) -> None:
    fixture = tmp_path / 'trace.txt'
    fixture.write_text(
        '-----BEGIN PRIVATE KEY-----\nMIIFAKE\n-----END PRIVATE KEY-----\n'
        'AWS_ACCESS_KEY_ID=AKIAIOSAMPLEEXAMPLE\n',
        encoding='utf-8',
    )
    proc = subprocess.run(
        [sys.executable, 'gate_context.py', str(fixture)],
        check=False,
    )
    assert proc.returncode != 0

This approach will not save you if the secret is split across chunks, base64 wrapped, or rendered inside a screenshot. It also will not satisfy a regulator who forbids sending customer content to any third party inference provider at all. Teams handling health records, cardholder data, or classified material should not use a remote coding model for those files. People who cannot run the gate on their own laptop should not paste production output into a browser chat either.

The contractor outside the glass can still help you rename a function, once the envelope contains only what you meant to share. Keep the threat model on one page, and keep raw stdout in a directory the agent cannot list. You will still ship bugs, yet you will ship fewer accidental keys, which is the incident most teams can actually prevent. That is enough of a win to keep the mail room boring, which is exactly how a trust boundary is supposed to feel.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The Crash Dump Is a Floor Plan

Riley Lin — Tue, 08 Sep 2026 03:43:28 +0000

You should treat a crash dump as a floor plan of your systems, not as a harmless error message. Remote coding models only need the failing assertion, the relevant source, and enough context to propose a patch. Everything else in a typical CI log is inventory: paths, hostnames, tokens, container ids, and fixtures that resemble real customers. If you paste the whole log, you have already given a stranger a sketch of how the building is wired.

This walkthrough is about that sketch, not about prompt cleverness or another gitignore lecture. You will inspect a realistic failure artifact, run a preflight redactor, and keep the topology on your side of the network. The same habit matters whether the model runs in a browser tab or on a borrowed machine across the planet. A consultant can help you fix a jammed door without taking home the master keyring.

What a simple CI failure actually contains

Imagine you asked for help on a flaky checkout test and pasted the job log because extraction felt slow. The log looks like an error, yet it reads like a tour of the office if you slow down. Runner labels, image digests, compose project names, and the fixture email in the assertion share one stream. A model does not need to be malicious to remember those details inside a transcript you cannot later unsend.

Here is a compressed sample that resembles logs many teams paste without a second look. Treat it as fiction, but notice how ordinary each line feels until you ask who should see it. Copy it into a file you control, then read it the way an outsider would read a stolen notebook. That extra pause is the whole security control you still have before the paste.

##[debug] Starting: checkout-integration
Runner name: gha-prod-euc1-17
Runner network: 10.8.4.0/24
IMAGE: ghcr.io/acme-internal/checkout-ci@sha256:9f3c000000000000000000000000000000000000000000000000000000000001
DATABASE_URL=postgres://checkout_ci:s8Coffee-Ridge@orders-ci.internal:5432/orders
STRIPE_TEST_KEY=sk_test_51NexampleNotARealKey9901
Using fixture customer: Ana Gomez <ana.gomez+prodlike@acme-customers.test>
AssertionError: expected total 4200, got 0
  at /home/runner/work/orders/orders/src/checkout/tax.py:88
  at /home/runner/work/orders/orders/src/checkout/tax.py:141
DEBUG jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwiaWF0IjoxNTE2MjM5MDIyfQ.signature
##[debug] Finishing: checkout-integration

You came for the assertion on tax.py, and that is the only sentence that describes the bug. The runner name hints at a region and a pool size, and the slash-twenty-four sketches a private network. That connection string is still a door key, because teams reuse CI passwords more often than they admit. The fixture is not production data, yet it is production-shaped, which is how quiet recon often begins.

A stack frame works like a room number on a door you did not mean to photograph. A container digest labels a locked cabinet, and a debug JWT acts like a visitor badge. You would not pin those photos on a public whiteboard and then call the board private. A remote transcript sits closer to that whiteboard than it sits to a sealed envelope.

Threat model in one pass

Your real asset is not one secret string; it is the graph those strings imply when they sit together. An attacker who never touches your cluster can still learn where CI lives and which registries you trust. The actor may be a curious operator, a compromised log store, or a later leak of assistant transcripts. You do not need a movie villain for the floor plan to become useful to somebody else.

The trust boundary is the moment bytes leave the machine that already holds the log. Local redaction, local summarization, and local extraction of the failing test all happen before that boundary. After the boundary, you should assume the transcript is copied, indexed, and kept longer than the chat UI suggests. You should treat remote inference as disclosure, then send the smallest true statement of the failure.

Tool-calling agents make the boundary easier to miss, because the model can request the log as a tool result. You thought you pasted a question; the agent thought it was helpful to attach the whole ci.log file. If you allow an assistant to read the working tree, the tool channel is the same disclosure as paste. The floor plan travels in both corridors, and neither corridor will send those bytes back to you.

A preflight you can run before any paste

Regex will not save a determined leak, but it will catch inventory you stopped seeing because it looks like plumbing. Save the script below as crash_preflight.py and point it at a file you were about to ship to a model. It prints findings with line numbers and refuses a clean exit when high-risk shapes appear in the text. You still make the final call; the script only slows the reflex to paste the entire dump.

#!/usr/bin/env python3
"""Preflight scan for crash dumps and CI logs before they leave the machine.

This is a heuristic gate, not a security boundary. Encoded, split, or
vendor-specific secrets will slip through. Review every hit by hand.
"""
from __future__ import annotations

import re
import sys
from pathlib import Path

RULES = [
    ("private_ipv4", re.compile(
        r"\b10\.\d{1,3}\.\d{1,3}\.\d{1,3}\b"
        r"|\b192\.168\.\d{1,3}\.\d{1,3}\b"
        r"|\b172\.(1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3}\b"
    )),
    ("connection_url", re.compile(
        r"\b(?:postgres|mysql|mongodb|redis|amqp)://[^\s]+", re.I
    )),
    ("pem_block", re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----")),
    ("jwt", re.compile(
        r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"
    )),
    ("aws_access_key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
    ("stripe_like", re.compile(
        r"\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}\b"
    )),
    ("github_pat", re.compile(
        r"\bghp_[A-Za-z0-9]{20,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b"
    )),
    ("email", re.compile(
        r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.I
    )),
    ("bearer", re.compile(
        r"\bBearer\s+[A-Za-z0-9._\-+=/]{12,}\b", re.I
    )),
    ("home_path", re.compile(
        r"/home/[^/\s]+|/Users/[^/\s]+|\\Users\\[^\\\s]+"
    )),
]

SOFT_RULES = [
    ("runner_or_cluster", re.compile(
        r"\b(gha-prod|eks-|arn:aws:eks|cluster\.local)\b", re.I
    )),
    ("internal_host", re.compile(r"\b[a-z0-9.-]+\.internal\b", re.I)),
    ("image_digest", re.compile(r"\bsha256:[a-f0-9]{64}\b")),
]


def scan(text: str) -> list[tuple[int, str, str]]:
    hits: list[tuple[int, str, str]] = []
    for lineno, line in enumerate(text.splitlines(), start=1):
        for name, rx in RULES + SOFT_RULES:
            if rx.search(line):
                excerpt = line.strip()
                if len(excerpt) > 160:
                    excerpt = excerpt[:157] + "..."
                hits.append((lineno, name, excerpt))
    return hits


def main(argv: list[str]) -> int:
    if len(argv) != 2:
        print("usage: crash_preflight.py <log-or-dump>", file=sys.stderr)
        return 2
    path = Path(argv[1])
    text = path.read_text(encoding="utf-8", errors="replace")
    hits = scan(text)
    if not hits:
        print(f"no heuristic hits in {path}")
        return 0
    print(f"{len(hits)} heuristic hit(s) in {path}")
    for lineno, name, excerpt in hits:
        print(f"  L{lineno:4d}  {name:18s}  {excerpt}")
    hard = {h[1] for h in hits} & {r[0] for r in RULES}
    return 1 if hard else 0


if __name__ == "__main__":
    raise SystemExit(main(sys.argv))

Run it against the sample after you save that text as sample.ci.log on your machine. A non-zero exit means you still owe the log a human pass, not that zero equals safety. The command below should fail closed on the sample, which is the result you want before any remote paste. Read the labels, then decide which rooms you can delete without hiding the actual assertion.

python3 crash_preflight.py sample.ci.log
echo $?

You should see hits on the private network, the database URL, the Stripe-shaped key, and the fixture email. The JWT, the runner name, the internal hostname, and the home-style path should light up as well. That list is the floor plan, and asking a model to ignore secrets does not erase the rooms they name. Stop sending those rooms; write a replacement artifact by hand so you do not launder the same file.

A model-sized failure report looks like the block below, and that smaller block is almost always enough. Keep it short enough that you could read it aloud without exposing a host, a person, or a key. If you cannot read it aloud, it is still a floor plan and it should not leave the machine.

Test: checkout tax total for a domestic cart
Expected: 4200
Actual: 0
Failing unit: src/checkout/tax.py, assertion near line 88
Nearby logic: tax.py lines 70-95 (rate table lookup) and 130-145 (rounding)
I cannot share CI env, runner names, image digests, or fixtures.
Question: which missing rate or rounding branch yields a zero total?

Notice what disappeared: accounts, regions, registries, people-shaped names, and every URL that named a host. Notice what remained: the behavior, the file, and a bounded question the model can actually answer. You can attach those seventy-five lines of tax.py if the function is self-contained and free of fixtures. You should not attach docker-compose.ci.yml, because compose files are floor plans with ports drawn in ink.

How to extract without dragging the building along

Commands help you slice the log the way you already slice a git bisect when a test goes red. Prefer extracting the assertion and the few frames that mention your package, then stop before the runner noise. The snippets below stay local and boring, which is the entire point of the extraction habit.

# Keep the assertion and nearby frames, then stop.
rg -n -C 3 "AssertionError|Error:|FAIL:" sample.ci.log | head -n 40

# Frames inside your code, not the runner image.
rg -n "work/orders/orders/src" sample.ci.log

# Replace production-shaped fixtures before anything leaves the machine.
sed -E \
  -e 's/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/user@example.test/Ig' \
  -e 's#postgres://[^[:space:]]+#postgres://redacted#g' \
  sample.ci.log > sample.ci.redacted.log

python3 crash_preflight.py sample.ci.redacted.log

Sed is not a cryptographic eraser, and you should not pretend a substitution is the same as deletion. It is a speed bump that makes the floor plan uglier, which is often enough to stop an accidental paste. If a line still looks like a badge after substitution, delete the line instead of decorating it. Models cannot patch code they never needed, and they cannot keep data you refused to send across the wire.

When an agent offers to read the log and summarize, summarize first on your own machine and paste only that. That inversion feels slower until you count how long a leaked CI credential takes to rotate everywhere it reached. Speed belongs to the extraction step, not to the upload step that follows a red failure.

Where a remote free assistant still fits

There are honest reasons to send a tightly bounded failure to a remote model, including a thin laptop. MonkeyCode is one such assistant, with free model access and a free server option for remote inference. Disclosure: This article was prepared as part of MonkeyCode's product outreach. You can still use that path for the redacted assertion and a local source slice while keeping raw runner logs on your machine.

A free remote hop is not a reason to lower the boundary you just drew with the preflight script. Convenience is how floor plans travel, so you should run the same gate every time bytes want to leave. If the assistant cannot propose a patch from the assertion plus seventy-five lines of tax.py, you probably need a test. Add a failing unit test that contains no customer-shaped names, and send that test instead of the inventory.

Limitations, and who should skip this

Heuristic preflight is a flashlight, not a lock, and determined leaks will walk around these regular expressions. Secrets split across lines, base64 blobs inside JSON, custom header names, and screenshots of logs will not match. Unicode lookalikes in URLs, truncated JWTs, and vendor tokens outside the shapes above will also pass quietly. If your threat model includes a motivated insider at the inference provider, do not send repository code there.

You should not use this workflow when the bug only reproduces with a production dump or a customer export. Packet captures and warehouse extracts belong in an incident channel with retention rules, not in a coding assistant. Skip remote models when license, contract, or regulation treats source as restricted even after a redaction pass. A green preflight exit is not legal advice, and it is not evidence that the file is empty of meaning.

Teams that already stream CI logs to a shared SaaS still have a different processor than a model transcript. Do not confuse the fact that a CI vendor saw the log with permission for any model to see it. Different processors keep different retention, and they have different incentives to train or debug from your paste. If you cannot name the processor, you are not ready to send the log off the machine.

The conclusion does not change with the brand of assistant you happen to have open today. Paste the assertion, the failing function, and a synthetic test, and keep the floor plan off the wire. Run the preflight until the extra minute bores you, because boring gates are the ones you will actually use. The crash dump will keep drawing your network in the margin, and your job is to mail the symptom only.

The Chat Panel Is Not the Record

Riley Lin — Mon, 07 Sep 2026 12:24:01 +0000

You already treat the repository as a trust boundary, yet the coding session copies secrets through a quieter channel. A key that never lands in git can still leave inside a prompt, a retry body, or a client log. If you only scan commits and ignore transcripts, you are reviewing the wrong artifact for assistant-assisted work. The durable record is not the chat widget you closed; it is every copy that widget left behind.

Think of the assistant as a courier hired for one hallway, not as a vault inside your office. The courier is useful and often inexpensive, but every envelope still crosses a door you do not control. Your job is not to fire the courier; it is to decide which pages may leave the building. You also need a record of that decision, because memory is not an audit control.

Most teams draw threat models around production services, then paste a stack trace into a model and stop thinking. The session path is shorter than a payment flow, but it still has four hops that matter for privacy. The editor holds the buffer, a packer builds the prompt, a network call leaves your process, and some log keeps a photocopy. Each hop has a different owner, a different retention clock, and a different person who will swear the file was deleted.

A .gitignore rule cannot save you on this path, because ignore files never see the HTTP body or the editor history. Undo stacks live on disk after you clear the visible thread, and debug clients log request bodies when a call fails at two in the morning. The remote side may keep prompts for abuse review even when you never asked anyone to train on your code. You cannot audit a hop you refuse to name, so name the hops before you paste another “minimal” reproduction.

A useful analogy is airport security for documents, not a debate about whether the model has a trustworthy personality. You are asking which bag is allowed on the plane, who photocopies the bag at the gate, and how long that photocopy sits in a drawer. Once you phrase the work that way, “just this once” stops sounding like a control and starts sounding like an unlabeled transfer. Unlabeled transfers are how secrets become folklore instead of incidents.

A coding model needs signatures, types, failing assertions, and the smallest fragment that still reproduces the fault in your head. It does not need production connection strings, session cookies, customer rows, or internal hostnames that map your network like a floor plan. Those extras feel helpful because they sit beside the bug, the way a badge lanyard sits beside a laptop on a cafe table. They remain credentials even when they appear in a comment, a fixture, or a “temporary” compose block.

Watch for quiet shapes that sneak into prompts more often than a raw .env file ever does in review. A JWT that you called redacted can still carry a readable payload, and a sample compose file can still point at a real internal name. A test dump may include one live customer email because somebody copied a staging row into the ticket. None of those look like AWS_SECRET_ACCESS_KEY, which is why a single grep for that string fails and then everyone relaxes.

Retry behavior belongs in the same threat model, not in a usability footnote about impatient chat. The first prompt might be clean because you were careful and slightly proud of yourself. The fifth retry grows because you paste a bit more context after the model guesses wrong in a confident tone. That extra context is where cookies, private URLs, and log excerpts tend to appear, like lint in a coat pocket after a long day. If you cannot explain why a paragraph must leave the machine, it stays on the machine.

The control that matches this model is deliberately boring: treat the payload as an egress file and inspect it before it becomes an HTTP body. The script below is a labeled proposal for a local tripwire, not a data-loss product, and it will miss encoded secrets so you keep reading. Save it as session_egress_scan.py and run it against the buffer you planned to send, not against the entire tree.

#!/usr/bin/env python3
"""Proposal: preflight scan for assistant prompts and leftover transcripts."""
from __future__ import annotations

import argparse
import json
import re
import sys
from pathlib import Path

PATTERNS = [
    ("private_key_block", re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----")),
    ("aws_access_key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
    ("generic_secret_assign", re.compile(
        r"(?i)\b(password|secret|token|api[_-]?key)\s*[:=]\s*\S{8,}"
    )),
    ("jwt_candidate", re.compile(
        r"\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b"
    )),
    ("connection_string", re.compile(
        r"(?i)\b(postgres|mysql|mongodb(\+srv)?|redis)://[^\s'\"]+"
    )),
    ("private_ipv4", re.compile(
        r"\b10\.\d{1,3}\.\d{1,3}\.\d{1,3}\b"
        r"|\b192\.168\.\d{1,3}\.\d{1,3}\b"
        r"|\b172\.(1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3}\b"
    )),
    ("internal_host", re.compile(r"(?i)\b[a-z0-9.-]+\.(internal|corp|lan|local)\b")),
    ("email_like", re.compile(r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.I)),
]


def scan_text(text: str) -> list[dict]:
    hits: list[dict] = []
    for name, pattern in PATTERNS:
        for match in pattern.finditer(text):
            line = text.count("\n", 0, match.start()) + 1
            snippet = match.group(0)
            if len(snippet) > 48:
                snippet = snippet[:24] + "…" + snippet[-8:]
            hits.append({"rule": name, "line": line, "preview": snippet})
    return hits


def redact_text(text: str) -> str:
    out = text
    for _name, pattern in PATTERNS:
        out = pattern.sub("[REDACTED]", out)
    return out


def iter_targets(path: Path) -> list[Path]:
    if path.is_file():
        return [path]
    files: list[Path] = []
    for child in path.rglob("*"):
        if child.is_file() and child.suffix.lower() in {".txt", ".md", ".log", ".json", ".jsonl"}:
            files.append(child)
    return files


def main() -> int:
    parser = argparse.ArgumentParser(
        description="Scan a prompt or a transcript directory before you forget it exists"
    )
    parser.add_argument("path", type=Path)
    parser.add_argument("--json", action="store_true")
    parser.add_argument("--write-redacted", type=Path, default=None)
    args = parser.parse_args()
    targets = iter_targets(args.path)
    report = []
    dirty = 0
    for file in targets:
        text = file.read_text(encoding="utf-8", errors="replace")
        hits = scan_text(text)
        report.append({"file": str(file), "hits": hits})
        if hits:
            dirty += 1
            if args.write_redacted is not None and file.is_file() and args.path.is_file():
                args.write_redacted.write_text(redact_text(text), encoding="utf-8")
    if args.json:
        print(json.dumps({"dirty_files": dirty, "results": report}, indent=2))
    else:
        for item in report:
            if not item["hits"]:
                print(f"clean: {item['file']}")
                continue
            print(f"residue: {item['file']} ({len(item['hits'])} hits)")
            for hit in item["hits"]:
                print(f"  L{hit['line']:>4}  {hit['rule']:<22}  {hit['preview']}")
    return 1 if dirty else 0


if __name__ == "__main__":
    sys.exit(main())

Run the checker twice, once against the outbound buffer and once against the places your editor actually writes. The second pass is the point of this article, because closing a panel is not the same as destroying a record. A clean git tree can still hide a dirty transcript in a cache directory you have not opened since last quarter.

python3 session_egress_scan.py /tmp/prompt.txt
python3 session_egress_scan.py /tmp/prompt.txt --write-redacted /tmp/prompt.redacted.txt
python3 session_egress_scan.py "$HOME/.cache" --json
echo $?

Keep a fixture beside the script so the control does not rot into a comment that nobody runs. The sample below is labeled test input and uses obviously fake values on purpose, which is the only kind of secret that belongs in a public gist.

# testdata/session_residue.txt
POST /login failed for user ada@example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0In0.faketail
DATABASE_URL=postgres://app:secret@db.prod.internal:5432/app
retry note: hop through 10.4.2.9 because the bastion timed out

python3 session_egress_scan.py testdata/session_residue.txt
# expected: non-zero exit, hits on jwt, connection string, internal host, email, private ipv4

If the exit code is non-zero, you do not bargain with the model about how sensitive the line “probably” is. You shrink the reproducing case until the scanner is quiet, then you send that smaller envelope and no other envelope. The model cannot unsee a secret you already shipped in round one, and neither can a log collector sitting behind that model. Treat a dirty scan like a failing test, not like a suggestion from a linter you plan to mute.

After the request leaves, you still have a local copy problem that git status will never mention in a standup. Chat panels, language-server logs, and HTTP debug dumps often keep the body of the last failing call for convenience. Search those paths on a laptop that has hosted an assistant for a week, and you will usually find a fragment you do not remember writing. That fragment is the shadow repository, and it deserves the same rotation story you already give to committed secrets.

# labeled examples — change roots to match your editor and operating system
rg -n "BEGIN (RSA |OPENSSH )?PRIVATE KEY|AKIA[0-9A-Z]{16}|postgres://" \
  "$HOME/Library/Logs" "$HOME/.cache" "$HOME/.local/share" 2>/dev/null
rg -n "Authorization: Bearer" . --glob '*.log'
python3 session_egress_scan.py "$HOME/.local/share" --json

Treat a hit in a log the same way you treat a hit in history: rotate the credential, then shorten retention on the file that stored the photocopy. Deleting the visible thread is not the same as deleting the backing store, especially when crash reports zip the last request for “support quality.” If your team cannot answer where transcripts live overnight, you do not have a privacy review. You have a hope wearing a checklist costume.

Free remote endpoints do not dissolve those hops, even when they are convenient for a laptop that should not host a GPU. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option, which can stand in for a self-hosted inference box during a narrow experiment. The threat model does not change when the far side is free: the prompt still leaves your process, and the server still sits outside the repository access list. Scan locally, send the redacted working set, and then grep your own logs for the strings you thought you had deleted.

This scanner is a tripwire, not a classifier and not a substitute for a reviewed data-loss program with owners and tickets. It will miss secrets in screenshots, minified bundles, chunked pastes, and strings that were base64-wrapped twice by a well-meaning helper. It will also flag emails and internal hostnames that you truly need, which is useful if you then write one sentence explaining the exception. False positives are cheaper than a production key that now lives in somebody else’s abuse queue.

Do not use this workflow as permission to send regulated data into any remote model, including a free one you spun up for a demo. If you handle health records, payment data, unpublished vulnerability notes, or customer exports under contract, keep those sessions on systems counsel already approved in writing. Do not launder a secret by redacting the variable name while leaving the value in a nearby stack frame. A clean scan is not evidence that a remote operator will delete logs on your preferred calendar.

The people who benefit are developers who already paste stack traces into assistants and want a repeatable pause before the network call. The people who should skip it are teams with no remote models, or teams that already broker every prompt through a reviewed gateway with retention rules. If you are in the first group, draw the four hops on paper, run the outbound file and the cache directory through the script, and only then ask the model to explain the failure. Send the smallest redacted fixture that still fails, then search the leftover record as if it were another clone of the repo.

Pack a Working Set, Not the Whole Tree

Riley Lin — Mon, 07 Sep 2026 11:03:25 +0000

Remote coding models are useful, but they should never receive your entire repository as a courtesy. You would not hand a visiting contractor a badge that opens every cabinet on the floor. The same instinct belongs in the packer that gathers files before a prompt crosses the network.

The practical conclusion is simple enough that you can act on it this week without new tooling. Name the files the model may see, scan that bundle for secrets, and refuse to send anything outside the list. Everything else in this article is a walkthrough of that export boundary, including a small script you can run before any remote session.

The threat is over-inclusion, not the model brand

Most accidental leaks in public incident writeups start with a helpful agent reading one directory too far. Your environment file, a fixture with real customer emails, or an internal runbook can ride along because the packer followed an import. The remote server then stores or logs that text under a retention policy you do not actually control. Agentic editors now ask for broad filesystem tools by default, which makes over-inclusion the common case rather than a rare misclick.

Think of the context window as a shipping crate sitting on a loading dock you still own. You choose the crate's contents, and the carrier only moves whatever you sealed before the pickup truck arrives. If the crate contains a private key, arguing about the carrier's privacy page does not unsend the crate. Classification therefore happens on your side of the dock, before any remote model session begins for the day.

A compact threat model keeps you honest about that dock without hiring a consultancy to draw posters. Assets include application source, live secrets, production hostnames, and customer-derived fixtures that sit under testdata directories. Actors include you, the editor plugin, the packer script, the remote inference server, and anyone who can read its logs. The trust boundary is the moment bytes leave localhost, whether you pasted a snippet or an agent called read_file.

You do not need a formal STRIDE workshop to put names on the usual failures around this boundary. Spoofing looks like a plugin talking to a different endpoint than the one you approved in settings. Tampering looks like a packer following a symlink out of the repository and into your home directory. Information disclosure is the default failure when the working set is the whole tree, and an unrestricted shell tool is elevation by another name.

What must never enter the crate

Start with files that are never source, even when they live in the same directory as source. Environment files, cloud credential documents, private keys, and registry tokens are credentials, not comments you forgot to delete. Generated dumps from local databases often contain real names even when the application code never prints those names. If a file would be an incident on a public gist, it does not belong in a remote context window either.

Test fixtures deserve the same suspicion you already apply to production data exports leaving the building. A realistic CSV checked in during a deadline can hold live emails, phone numbers, or leftover session cookies. If a model only needs structure, synthesize a fake row with the same columns and none of the real people. The analogy is a fire drill that uses cardboard boxes, not a drill that wheels the real safe into the parking lot.

Conversation history is a second crate that people forget once the current prompt finally looks clean enough. A secret pasted five turns ago still sits in the thread the remote server will resend as context. If you discover a leak in an earlier message, later caution in the same chat cannot retract those bytes. You start a new session from a cleaned working set, and you rotate the credential as if it had been emailed.

A packer you can fail in CI

The helper below is a local gate, not production security software you should market as a control. It reads a manifest of relative paths, rejects escapes from the repo root, and scans the concatenated bundle for high-risk patterns. You should extend the pattern list for your stack, because the point is a gate that fails closed.

#!/usr/bin/env python3
"""working_set.py — allowlist packer with a closed-fail secret scan."""
from __future__ import annotations

import argparse
import json
import re
import sys
from pathlib import Path

DENY_NAMES = {
    ".env",
    ".env.local",
    "id_rsa",
    "id_ed25519",
    "credentials.json",
    "serviceAccount.json",
}

DENY_SUBSTRINGS = ("/secrets/", "/.aws/", "/.ssh/", "/.gnupg/")

SECRET_PATTERNS = [
    re.compile(r"AKIA[0-9A-Z]{16}"),
    re.compile(r"-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----"),
    re.compile(r"(?i)api[_-]?key\s*[:=]\s*['\"][^'\"]{8,}['\"]"),
    re.compile(r"(?i)secret\s*[:=]\s*['\"][^'\"]{8,}['\"]"),
    re.compile(r"ghp_[A-Za-z0-9]{20,}"),
    re.compile(r"xox[baprs]-[A-Za-z0-9-]{10,}"),
]


def load_manifest(path: Path) -> list[str]:
    data = json.loads(path.read_text(encoding="utf-8"))
    if not isinstance(data, dict) or "paths" not in data:
        raise SystemExit("manifest must be JSON with a top-level 'paths' array")
    return list(data["paths"])


def resolve_allowed(repo: Path, relpaths: list[str]) -> list[Path]:
    resolved: list[Path] = []
    for rel in relpaths:
        candidate = (repo / rel).resolve()
        if repo.resolve() not in candidate.parents and candidate != repo.resolve():
            raise SystemExit(f"path escapes repo: {rel}")
        if not candidate.is_file():
            raise SystemExit(f"missing file: {rel}")
        resolved.append(candidate)
    return resolved


def is_denied(repo: Path, file_path: Path) -> str | None:
    if file_path.name in DENY_NAMES:
        return f"denied filename: {file_path.name}"
    try:
        rel = file_path.relative_to(repo).as_posix()
    except ValueError:
        return "path outside repo"
    parts = rel.split("/")
    for token in DENY_SUBSTRINGS:
        fragment = token.strip("/")
        if fragment in parts:
            return f"denied path fragment: {rel}"
    return None


def scan_text(label: str, text: str) -> list[str]:
    hits = []
    for pattern in SECRET_PATTERNS:
        if pattern.search(text):
            hits.append(f"{label}: matched {pattern.pattern}")
    return hits


def main() -> int:
    parser = argparse.ArgumentParser(description="Pack an allowlisted working set")
    parser.add_argument("--repo", type=Path, default=Path("."))
    parser.add_argument("--manifest", type=Path, required=True)
    parser.add_argument("--out", type=Path, required=True)
    args = parser.parse_args()
    repo = args.repo.resolve()
    files = resolve_allowed(repo, load_manifest(args.manifest))
    findings: list[str] = []
    chunks: list[str] = []
    for file_path in files:
        reason = is_denied(repo, file_path)
        if reason:
            findings.append(f"{file_path}: {reason}")
            continue
        text = file_path.read_text(encoding="utf-8", errors="replace")
        rel = file_path.relative_to(repo).as_posix()
        findings.extend(scan_text(rel, text))
        chunks.append(f"\n/* FILE: {rel} */\n{text}")
    args.out.write_text("".join(chunks), encoding="utf-8")
    if findings:
        sys.stderr.write("working set rejected\n")
        sys.stderr.write("\n".join(findings) + "\n")
        return 2
    print(f"packed {len(files)} files into {args.out}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

A tiny manifest keeps the allowlist reviewable in pull requests, which is the whole reason it exists as a file. You want that file to look boring, because boring means someone thought about the boundary before the session started. Commit the manifest beside the module it describes, so review happens where the code already changes.

{
  "paths": [
    "src/billing/prorate.py",
    "src/billing/prorate_test.py",
    "docs/billing-rules.md"
  ]
}

Run it from the repository root before you open a remote chat, and keep the output on a private temporary path. The commands below also remind you that an environment file should stay off the manifest on purpose. If the command prints a rejection, you fix the bundle locally instead of negotiating with the model about redaction.

python3 working_set.py --manifest working-set.json --out /tmp/working-set.txt
stat .env >/dev/null 2>&1 && echo "remember: .env stays off the manifest"
wc -l /tmp/working-set.txt

You can wire the same command into CI so a new helper file cannot join the crate without a review. The test below writes fixtures into a temporary directory and expects a non-zero status when a fake key is present. If the dirty case ever returns zero, your gate is theater and you should treat that as a packer incident.

# test_working_set.py — run with: python3 test_working_set.py
import json
import subprocess
import sys
import tempfile
from pathlib import Path

HELPER = Path(__file__).with_name("working_set.py")


def pack(repo: Path, paths: list[str], contents: dict[str, str]) -> subprocess.CompletedProcess:
    for rel, body in contents.items():
        target = repo / rel
        target.parent.mkdir(parents=True, exist_ok=True)
        target.write_text(body, encoding="utf-8")
    manifest = repo / "working-set.json"
    manifest.write_text(json.dumps({"paths": paths}), encoding="utf-8")
    out = repo / "bundle.txt"
    return subprocess.run(
        [
            sys.executable,
            str(HELPER),
            "--repo",
            str(repo),
            "--manifest",
            str(manifest),
            "--out",
            str(out),
        ],
        capture_output=True,
        text=True,
    )


def main() -> None:
    with tempfile.TemporaryDirectory() as tmp:
        repo = Path(tmp)
        clean = pack(
            repo,
            ["src/ok.py"],
            {"src/ok.py": "def add(a, b):\n    return a + b\n"},
        )
        assert clean.returncode == 0, clean.stderr
        dirty = pack(
            repo,
            ["src/ok.py", "src/leak.py"],
            {
                "src/ok.py": "def add(a, b):\n    return a + b\n",
                "src/leak.py": 'api_key = "supersecretvalue123"\n',
            },
        )
        assert dirty.returncode == 2, dirty.stdout
        print("working_set tests passed")


if __name__ == "__main__":
    main()

Where a free remote coding server fits

Once the crate is sealed, you still have to choose a destination that matches the sensitivity of those files. A local-only model keeps the crate in the building, which remains the right default for regulated source. Many teams still want a remote assistant for ordinary application code that has already been stripped of secrets.

MonkeyCode is one option in that second bucket for ordinary application code that may leave the machine. It is an open-source coding product that offers free model access and a free server option after you have packed the working set. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The free remote path does not change the threat model; it only makes the export cheaper, which can tempt a wider crate.

Use the packer first, then paste or attach only the output file into the remote session you actually need. If the task is explaining one prorate function, the model does not need Terraform, Docker secrets, or last quarter's analytics export. Cheap inference is not a reason to widen the crate, and free does not mean the uploaded bytes later vanish. If that workflow already matches how you handle non-sensitive modules, you can try the free server option on a public sample first.

Read the project's own policy for logs and retention instead of assuming a free endpoint keeps no history. Your working-set manifest is the record of what you intended to export, so keep it beside the session notes. If the policy is unclear for your industry, you do not send the crate, packed or otherwise.

Limitations, and who should skip this

This packer is a seatbelt, not an airbag farm, and it will miss secrets that do not match the regular expressions. Custom tokens, long-lived session strings, and sensitive prose will sail through unless you add patterns for them. It will not stop an agent with unrestricted shell tools from reading files you never packed into the crate. If your editor plugin can search the disk for private keys, the manifest is advisory until those tools are disabled.

Teams under contractual data residency rules should not send source to any free remote server, packed or not. The same refusal applies to health records, payments code, and unpublished security work that is not already public. Those codebases belong on models that stay inside your tenancy, with a paper trail your counsel already approved.

The approach also fails if humans bypass it with screenshots, stack traces, or a quick paste of inspect output. The working set is a habit, and habits break when people are stuck and the model is one paste away. You should still rotate anything that might have crossed the boundary, because least privilege does not create a time machine. If this workflow feels heavy for a throwaway kata on public sample code, skip it and keep that sample public.

The crate metaphor holds only if you remember who packs it, because the model merely unpacks what you shipped. Name the files, scan the bundle, and send that bundle alone when the destination is a remote coding server. Everything else can stay on the dock you already control, including the secrets the model never needed.