DEV Community: Riley Lin

Name Every Door Before the Prompt Leaves

Riley Lin — Sun, 11 Oct 2026 21:52:26 +0000

You should hold a prompt until you can name every room it will enter, because each room is a new trust boundary. A model service, a hosted server, and your own log pipeline are three different rooms even when one vendor offers all three. Free access does not shrink those rooms, and a friendly price does not change who can read what you paste. The useful habit is to label the payload, refuse the hot fields, and only then decide whether a remote run is acceptable.

The mistake usually starts with convenience, which feels like one door when the path is really a hallway. You paste a stack trace to explain a bug, and the trace still carries a connection string from the process environment. You attach a config snippet to show a path, and the snippet still carries a token that your linter never flagged. You then ask a hosted model to edit that same tree on a remote server, so one gesture crosses two boundaries.

Treat that gesture as a transfer, not as a chat, and the threat model becomes easier to draw on paper. Your laptop is the room you control, while the model endpoint is a room you only rent for a reply. The server is a third room, because it stores files and runs commands after the chat window has already closed. Logs form a fourth room, since retention and support access often outlive the session that created them.

If you cannot say which of those four rooms will see a given field, you are not ready to send the field. A request identifier can move, while the authorization header on the next line cannot, even though both arrived together. A file path can reveal a customer name or a private repository that you never intended to publish. You can keep the exception type and the line number, and you should drop the headers, the query string, and the body.

MonkeyCode enters this walkthrough only as one option where a free model path and a free server option may sit behind those doors. Disclosure: This article was prepared as part of MonkeyCode's product outreach. You should read the current terms yourself before you rely on either offer, because availability language goes stale faster than most posts. This article does not name models, quotas, hardware, or a promised duration, because those details were not verified from a primary page here.

If a product page advertises a token grant or a free machine, treat that page as the source of truth. Check the page on the day you start, because a number copied from an old thread is not evidence. A screenshot without a date is not a contract, and a recycled paragraph cannot enroll you. You can use the offer after you confirm it, and the security decision stays the same when the invoice is zero.

The fields you should never send are the ones that grant access, identify a person, or reconstruct a private system. A cloud key, a session cookie, a private key block, and a database URL all sit in the first class. Customer names inside a frame, raw request bodies, and unredacted support notes sit in the second class. Internal hostnames, tenant bucket names, and full environment dumps sit in the third class even when they look like ordinary debugging detail.

A useful analogy is a hotel hallway rather than a locked diary, because each door has a different reader behind it. The model door is read by a service that produces text, and that service may retain prompts under a policy you have not opened. The server door is read by a machine image that can copy your tree into a workspace you do not administer. The log door is read later by search tools, billing jobs, and sometimes a person who is debugging your debugging.

You need a local gate that fails closed, because a careful intention does not survive a tired paste at the end of the day. Copy the candidate text into a fixture, run the classifier, and read the verdict before you open a chat box. The classifier does not need to understand your product, since pattern refusal is enough to stop the obvious leaks. Rewrite the fixture until the verdict is clean, and allow only that clean fixture to cross any remote boundary.

A gate that fails closed

The script below is a proposed local gate, and you should run it on your own samples before you trust its patterns. It knows three outbound destinations, and it refuses to treat your laptop as a destination because the laptop is the source. It looks for assignment-style secrets, private key banners, common connection URLs, a familiar cloud key shape, bearer tokens, and email addresses. A match prints the rule name and returns a nonzero status, which is the signal your wrapper should treat as stop.

#!/usr/bin/env python3
"""Proposed local gate. It labels outbound text and never calls a model."""

import re
import sys
from pathlib import Path

DESTINATIONS = ("model", "server", "logs")

RULES = [
    (
        "assignment_secret",
        re.compile(
            r"(?i)\b(?:api[_-]?key|secret|token|password|passwd)\b\s*[:=]\s*\S+"
        ),
    ),
    (
        "private_key",
        re.compile(r"-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----"),
    ),
    (
        "connection_url",
        re.compile(r"(?i)\b(?:postgres|mysql|mongodb|redis|amqp)://\S+"),
    ),
    ("cloud_key_shape", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
    ("bearer_token", re.compile(r"(?i)\bBearer\s+\S+")),
    (
        "email_address",
        re.compile(r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b"),
    ),
]


def classify(text):
    found = []
    for name, pattern in RULES:
        if pattern.search(text):
            found.append(name)
    return found


def main():
    if len(sys.argv) != 3:
        print("usage: boundary_gate.py <model|server|logs> <file>")
        return 2
    destination = sys.argv[1]
    path = Path(sys.argv[2])
    if destination not in DESTINATIONS:
        print("refuse destination=unknown")
        return 2
    text = path.read_text(encoding="utf-8")
    hits = classify(text)
    if hits:
        for name in hits:
            print(f"refuse field={name} destination={destination}")
        return 1
    size = len(text.encode("utf-8"))
    print(f"allow destination={destination} bytes={size}")
    return 0


if __name__ == "__main__":
    sys.exit(main())

You can create two fixtures and compare them with the same command shape, which keeps the ritual boring enough to repeat. The hot fixture should fail for model, server, and logs, because a secret stays hot in every rented room. The clean fixture should pass those same three destinations, and the allow line should mention only a byte count. If the hot fixture ever exits zero, you have a broken pattern, and you should fix the gate before you fix the prompt.

mkdir -p fixtures
cat > fixtures/stack_hot.txt << 'EOF'
CheckoutError: timeout in charge_card
Authorization: Bearer ya29.example-not-a-real-token
customer=ada@example.com
DATABASE_URL=postgres://app:example@db.internal:5432/shop
EOF
cat > fixtures/stack_clean.txt << 'EOF'
CheckoutError: timeout in charge_card
status=504
hint=upstream timed out before capture
EOF
python3 boundary_gate.py model fixtures/stack_hot.txt
python3 boundary_gate.py server fixtures/stack_hot.txt
python3 boundary_gate.py logs fixtures/stack_hot.txt
python3 boundary_gate.py model fixtures/stack_clean.txt
python3 boundary_gate.py server fixtures/stack_clean.txt
python3 boundary_gate.py logs fixtures/stack_clean.txt

Imagine a synthetic checkout trace that includes a bearer token, a customer email, and a postgres URL on three lines. You want help with the exception class, so you keep the class name, the status code, and the function name in the clean fixture. You delete the bearer line, you replace the email with a placeholder, and you replace the URL with the word database. You then run the gate against model, server, and logs, and you send the prompt only after all three runs exit zero.

That sequence is the whole method, and it is deliberately slower than pasting the terminal straight into a chat box. The slowness is the control, in the same way a badge reader is slower than an open lobby. You are not hiding the bug from the model, and you are hiding credentials from every room but your own. A model can still explain a timeout when the token and the mailbox are gone, because the failure shape remains.

There is a second decision after the gate, and it concerns what the server is allowed to hold even when the prompt is clean. A clean prompt can still travel with a dirty tree if you upload the real repository to a machine you do not run. Environment files, shell history, and editor swap files skip the prompt check unless you point the script at them too. Run the same script over those files before any sync, and keep the remote copy limited to what you already chose to share.

Where the gate stops

This gate has sharp limits, and you should say them out loud before you trust a green exit code. Regular expressions miss secrets that are split, encoded, or named in a way the rules do not expect. They also miss private meaning with no classic shape, and they can flag a harmless email you meant to keep. A clean result means those known patterns were absent, and it does not mean the text is safe for every legal regime.

You should not use this approach as your only control if you handle health records, payment data, or material under a written retention contract. You should not use it if a green script would persuade you to skip reading the host policy. You should not use it if your team needs centralized revocation, audit exports, or a reviewer who did not write the prompt. In those settings you need an approved data-loss process, and a local fixture check is only a rehearsal.

A free server option changes the cost conversation, and it does not change the custody conversation in any important way. Someone else still schedules the machine, images the disk, and decides how long a forgotten workspace remains mounted. You can enjoy the lower cost after the gate is green, and you should still assume the room can be inspected. If that assumption feels too strict for the data in front of you, keep the run on the laptop and send nothing.

When you want a remote practice room, confirm current free model access and the free server option on MonkeyCode's own page. Enroll only after that check, then send a fixture this gate has already marked clean for every destination. If the page no longer matches what you expected, believe the page and keep the payload local until the terms are clear. The boundary work remains useful even if you never create an account, because the four rooms exist on every host.

Classify the Payload Before It Leaves

Riley Lin — Sat, 10 Oct 2026 18:26:24 +0000

You should treat every hosted coding model as a guest that can read only the crates you deliberately load. A free price does not shrink that guest's memory, and a free server does not become your compliance boundary. Before you wire a review loop to any remote model, label each field as local, shareable, or forbidden. That label should fail the request inside your process, before a client library is allowed to serialize it.

Picture the path as a loading dock rather than a chat box you fill between meetings. Your editor is the warehouse, your agent is the clerk, and the hosted model waits outside as a visitor. The clerk will stack diffs, logs, and tool traces onto one pallet because one request feels efficient. Write those dock rules into the client path, or the visitor receives the whole pallet by ordinary habit.

Four zones on the dock

Name four zones on paper, and grant each zone only the trust you can actually defend. The editor zone may hold secrets, because those bytes are supposed to stay on a disk you administer. The local agent zone may read those files, yet it must not forward them without a label. A free server zone is still someone else's process, with logs, backups, and administrators you do not schedule.

The model zone is a separate recipient, even when one vendor operates both the server and the weights. A free server can change what you pay, and it can change which machine starts the process. It does not change who is allowed to read the payload after your client posts it. Assume prompts, tool arguments, and captured stderr may be stored for abuse review or for debugging.

Confirm retention, region, and training use in the documentation that is current on the day you connect. If those pages are silent or contradictory, keep the payload on the warehouse side of the dock. Do not send a customer trace, a production environment file, or a private key just because the call is free. A low price is not a control, and a new model release is not a control either.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The operator of this draft describes MonkeyCode as an open-source project with free model access and a free server option. This walkthrough stays useful if you remove that product, and it claims no quota, hardware shape, or lasting price. Read the repository on the day you connect, because availability language becomes stale without a fresh primary source.

Run the gate before the client

The artifact you should add is a field classifier that runs before any client posts JSON. The script below is an unexecuted example, not a benchmark, and you should widen the deny list for your own tree. It reads one payload from standard input, walks nested keys, and prints a label for every match. A forbidden match exits with status 2, a local-only match exits with status 1, and a clean payload exits with status 0.

#!/usr/bin/env python3
'''Unexecuted example: label fields before a model request is sent.'''

import json
import re
import sys

# False positives are expected on names such as token_count.
FORBIDDEN_KEY = re.compile(
    r'(api[_-]?key|secret|password|token|authorization|private[_-]?key|cookie|credential)',
    re.I,
)
LOCAL_ONLY_KEY = re.compile(
    r'(stack|traceback|env|home_path|email|phone|session)',
    re.I,
)
SHAREABLE_KEY = re.compile(
    r'(diff_summary|language|test_name|public_error_code|file_role)',
    re.I,
)
VALUE_HINT = re.compile(
    r'(AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]+PRIVATE KEY-----|Bearer\s+\S+)',
    re.I,
)

def walk(node, path='$'):
    findings = []
    if isinstance(node, dict):
        for key, value in node.items():
            child = f'{path}.{key}'
            if FORBIDDEN_KEY.search(key):
                findings.append((child, 'forbidden'))
            elif LOCAL_ONLY_KEY.search(key):
                findings.append((child, 'local_only'))
            elif SHAREABLE_KEY.search(key):
                findings.append((child, 'shareable'))
            findings.extend(walk(value, child))
    elif isinstance(node, list):
        for index, value in enumerate(node):
            findings.extend(walk(value, f'{path}[{index}]'))
    elif isinstance(node, str) and VALUE_HINT.search(node):
        findings.append((path, 'forbidden_value'))
    return findings

def main():
    payload = json.load(sys.stdin)
    findings = walk(payload)
    for path, kind in findings:
        print(f'{kind}\t{path}')
    kinds = {kind for _, kind in findings}
    if 'forbidden' in kinds or 'forbidden_value' in kinds:
        return 2
    if 'local_only' in kinds:
        return 1
    return 0

if __name__ == '__main__':
    sys.exit(main())

Run the clean fixture first, and expect status 0 when the payload contains only shareable keys. Run the secret fixture next, and expect status 2 because the key name itself is already a secret channel. Run the traceback fixture after that, and expect status 1 so a local-only field still cannot leave. Wire the same check in front of your client so a failing status never reaches the network call.

python3 gate_payload.py <<'JSON'
{"language":"python","diff_summary":"rename helper","test_name":"test_gate"}
JSON
echo "clean exit:$?"

python3 gate_payload.py <<'JSON'
{"diff_summary":"rename helper","api_key":"sk-live-do-not-send"}
JSON
echo "forbidden exit:$?"

python3 gate_payload.py <<'JSON'
{"diff_summary":"rename helper","traceback":"/home/dev/app.py"}
JSON
echo "local-only exit:$?"

Save the classifier as gate_payload.py, mark it executable, and keep it beside the fixtures rather than on the server. Pass the fixture on standard input, capture the status, and exit before curl or your SDK if that status is not zero. A shell guard is enough for a personal loop, and the unexecuted sketch below shows the shape. That ordering matters more than the product behind the URL, because a skipped local check cannot be undone remotely.

python3 gate_payload.py < fixture.json
status=$?
if [ "$status" -ne 0 ]; then
  printf '%s\n' "refusing model call: gate status ${status}" >&2
  exit "$status"
fi

What never gets a ticket

You should keep raw environment dumps, authentication headers, and private key blocks inside the editor zone. Customer identifiers, session cookies, and full stack traces belong in the local-only class until you rewrite them. A public error code, a language name, and a shortened diff summary can cross if you have already removed names. When you are unsure, refuse the send, because a missed label is cheaper than a leaked credential.

This gate fails closed on key names, yet a bland key such as note can still hide a secret. Split tokens, base64 blobs, and secrets pasted into a diff hunk will also walk past a short pattern list. You should add a second pass that scans values, and you should review the diff by eye before a new fixture is trusted. The script does not encrypt traffic, prove deletion, or tell you which region accepted the bytes.

Do not use this approach for health records, payment data, or any payload a regulator already named. Do not use it as a substitute for a contracted data-processing review, a private network boundary, or a real DLP product. Skip it if your team cannot explain where logs live, because the gate only stops what it can see. A solo developer cleaning a personal repository can use it, while a hospital integration team should not.

Practice only on labeled fixtures

Build the review loop in three quiet steps, and keep production traffic out of every step. First, copy a failing test into a fixture file that contains no paths from your home directory. Second, run the classifier and stop if the status is not zero, even when the failure looks harmless. Third, send only that fixture to the hosted model, then paste the suggestion back through the same classifier before you apply it.

Treat the completion as untrusted text that arrived from the visitor, not as a patch you already reviewed. A suggestion can reintroduce a secret you stripped, or it can recommend a command that reads a local credential file. Run the classifier on the reply, and refuse any command that touches your environment, your SSH directory, or your shell history. If the reply is only a rewritten function with no new identifiers, you can apply it in a branch and run your ordinary tests.

If you practice on a free server, create a project that holds fixtures only, and never mount your real home directory into it. Point the client at that project, and keep the classifier on your laptop so a remote shell cannot skip it. A free process can still write logs you do not rotate, so send the smallest fixture that reproduces the bug. Delete the remote project when the exercise ends, and do not treat deletion as proof that every copy is gone.

The conclusion is simple: label the crates, fail closed, and let the model see only what you would post in a public gist. Free model access is a convenient place to rehearse that habit, not a reason to skip the habit. If you want a hosted target for labeled fixtures, read the current MonkeyCode repository and connect only after the terms match your map. Leave production logs, customer names, and live credentials in the warehouse, where the visitor was never invited.

A Free Host Is Still a Foreign Room

Riley Lin — Fri, 09 Oct 2026 14:55:50 +0000

You should treat a free inference host as a foreign room, not as a harmless sandbox on your desk. Free access lowers the price of a trial, but it does not move that room inside your trust boundary. Secrets, raw logs, and customer identifiers still cross a network when you paste them into a prompt. If you cannot name the room and the exit, you are not ready to send the packet.

Picture your laptop as a house that has three working rooms and one locked porch outside. The first room holds source that you may discuss in abstract terms after you strip identifiers. The second room holds logs, tickets, and traces that still carry names and live account numbers. The porch is the remote host, and a free server waits there like any other vendor machine.

A coding agent is the courier who walks between those rooms while carrying a large open bag. The courier will pick up whatever the shell can read, including files you forgot and variables you inherited. You do not fix that habit by hoping the remote model will be polite about private material. You fix it by writing a deny manifest before the courier is allowed to leave the house.

The boundary is the packet, not the price

Price is a poor proxy for trust, because a cheap door can still open onto someone else's disk. When the host is free, you often know less about retention, tenancy, and operator logs than you would after a signed review. You should assume the porch keeps a copy until a current policy, which you have actually read, says otherwise. You should not invent a retention window, a region, or a deletion promise that the operator never published.

That assumption changes what you may pack, because a comment with an internal hostname belongs in the second room. A stack trace that includes a query string is still a log, even when you prefer to call it a bug report. An environment file is a key ring, and a key ring never rides in the same bag as a question. A screenshot of a dashboard is still a document, because pixels can carry the same names as plain text.

Tool output deserves the same sorting, because a command can print a secret the prompt never contained. If your agent runs env, git config --list, or a verbose HTTP client, the transcript becomes a second letter. You should gate the command before you gate the paragraph, since stdout can be louder than typing. A foreign room does not become safe because the secret arrived through a tool transcript instead of your keyboard.

Run a deny manifest before the session

The artifact below is a local preflight, not a certified control, and you should treat the rules as a starting deny list. It targets Python 3.10 or newer, walks the tree, and never prints a secret value it finds. You run it on a toy repository first, then you read every review hit before you open a remote session. If the script exits with a nonzero status, you keep the coding agent away from that tree.

demo=$(mktemp -d)
mkdir -p ${demo}/src
cat > ${demo}/src/app.py <<'EOF'
def add(a, b):
    return a + b
EOF
cat > ${demo}/.env <<'EOF'
API_TOKEN=replace-me
EOF
python3 room_manifest.py --root ${demo} --env-file ${demo}/.env
python3 room_manifest.py --root ${demo} --include-process-env
rm -rf ${demo}

#!/usr/bin/env python3
'''Local preflight: classify paths and env keys before a remote session.

Illustrative example, not a certified control. A green result is not
approval to upload production data or regulated records.
'''

from __future__ import annotations

import argparse
import os
import sys
from pathlib import Path

DENY_NAMES = {
    '.env',
    '.env.local',
    '.npmrc',
    '.pypirc',
    'id_rsa',
    'id_ed25519',
    'credentials.json',
    'service-account.json',
}
DENY_SUFFIXES = {'.pem', '.p12', '.pfx', '.key', '.kdbx'}
REVIEW_SUFFIXES = {'.log', '.har', '.pcap', '.trace', '.sql'}
REVIEW_NAMES = {'dump.sql', 'seed.sql', 'tokens.txt'}
HOT_ENV_HINTS = ('SECRET', 'TOKEN', 'PASSWORD', 'PASSWD', 'KEY', 'CREDENTIAL')
PREFIX_HINTS = ('AWS_', 'GOOGLE_', 'AZURE_', 'GITHUB_')
TEXT_RULES = (
    ('private_key_block', 'BEGIN PRIVATE KEY'),
    ('aws_access_key_prefix', 'AKIA'),
    ('github_pat_prefix', 'ghp_'),
    ('slack_bot_prefix', 'xoxb-'),
)
SKIP_DIRS = {'.git', 'node_modules', '.venv', 'venv', '__pycache__'}
MAX_BYTES = 200_000


def classify_path(path: Path) -> str:
    name = path.name.lower()
    if name in DENY_NAMES or path.suffix.lower() in DENY_SUFFIXES:
        return 'deny'
    if name in REVIEW_NAMES or path.suffix.lower() in REVIEW_SUFFIXES:
        return 'review'
    return 'allow'


def classify_env_key(key: str) -> str:
    upper = key.upper()
    if any(hint in upper for hint in HOT_ENV_HINTS):
        return 'deny'
    if upper.startswith(PREFIX_HINTS):
        return 'review'
    return 'allow'


def sniff_text(path: Path) -> list[str]:
    if path.stat().st_size > MAX_BYTES:
        return ['too_large']
    try:
        text = path.read_text(encoding='utf-8', errors='replace')
    except OSError:
        return ['unreadable']
    return [rule for rule, needle in TEXT_RULES if needle in text]


def iter_env_keys(env_file: Path | None, include_process: bool) -> list[str]:
    keys = set(os.environ) if include_process else set()
    if env_file and env_file.is_file():
        raw = env_file.read_text(encoding='utf-8', errors='replace')
        for line in raw.splitlines():
            line = line.strip()
            if not line or line.startswith('#') or '=' not in line:
                continue
            keys.add(line.split('=', 1)[0].strip())
    return sorted(key for key in keys if key)


def main() -> int:
    parser = argparse.ArgumentParser(
        description='Deny-list preflight for a remote session'
    )
    parser.add_argument('--root', type=Path, required=True)
    parser.add_argument('--env-file', type=Path)
    parser.add_argument('--include-process-env', action='store_true')
    args = parser.parse_args()
    root = args.root.resolve()
    flagged = 0
    for path in root.rglob('*'):
        if not path.is_file():
            continue
        if any(part in SKIP_DIRS for part in path.parts):
            continue
        kind = classify_path(path)
        rel = path.relative_to(root)
        if kind != 'allow':
            print(f'{kind}  path  {rel}')
            flagged += 1
            continue
        for rule in sniff_text(path):
            print(f'review  content  {rel}  {rule}')
            flagged += 1
    for key in iter_env_keys(args.env_file, args.include_process_env):
        kind = classify_env_key(key)
        if kind == 'allow':
            continue
        print(f'{kind}  env  {key}')
        flagged += 1
    print(f'flagged={flagged}')
    return 1 if flagged else 0


if __name__ == '__main__':
    sys.exit(main())

deny  path  .env
deny  env  API_TOKEN
flagged=2

The walk includes ignored files, because a gitignore rule hides a file from commits and not from an agent. The sample above matches the first command only, and you should see two deny lines plus a flagged count of two. On a machine with a hot shell, the second command adds deny lines that you must clear or isolate. You isolate that shell before the session, rather than editing the script until the exit code looks friendly.

Read the hits before you trust them

A deny hit means the courier must not leave with that object, even when your question feels narrow. A review hit means you open the file or the key name, then you either redact it or leave it behind. An allow hit means the name looks ordinary, not that the bytes inside are safe to share. You still open the diff, because a file called notes.md can hold an email that no suffix rule will catch.

You can think of the script as a coat check at the door, rather than as a judge of the conversation. The coat check stops the obvious bags, and it will miss a story that uses no secret-shaped string. After the script passes, you still read the prompt and ask whether a stranger should know that story. If the answer feels uneasy, you rewrite the question with synthetic names and a trimmed stack.

Commands belong in that same pause, because a tool transcript can smuggle the second room onto the porch. Before the agent runs a collector, you decide whether the output may be echoed back to the host. A quiet git status on a scrubbed toy repo is usually a smaller risk than a full environment dump. You allow a command by writing it down, and you forbid a command by keeping it out of the tool list.

Use a free host only for the dry run

Once the manifest is clean, a remote model can help you practice the workflow on fixtures you invented. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option, which can host a dry run on synthetic code. Those availability claims are not a quota, a hardware bill, a region, or a promise that the offer remains.

You read the current product notes before you rely on either claim, because free terms can change without drama. You use the dry run to rehearse the boundary, not to process a real incident from yesterday. You might ask the model to explain a toy function, to suggest a test, or to review a scrubbed diff. You do not ask it to summarize a production log, even when that log looks mostly redacted to you.

A mostly redacted log is still a log, and the missing mask is where names tend to hide. If the session starts requesting uploads you did not plan, you stop and return to the manifest. People who already hold production secrets, payment data, or health records should not treat this script as their control. A local checker cannot replace a data-loss tool, a vendor review, or a decision from your security team.

Teams that cannot name the operator, the retention statement, and the readers of server logs should wait. If your written policy forbids third-party inference, a free price does not create a quiet exception. Unreleased customer exports belong in that same wait, because a tutorial script is not a boundary control.

Say the limits out loud

Path rules miss secrets that live inside ordinary source, and env rules miss values sitting in shell history. The checker does not know what an earlier session already stored on a host you opened last week. It does not watch the network, so a different client can still bypass it when you leave that client open. You should treat a green exit as permission to keep reading, not as permission to stop thinking.

Free access can also train a bad habit, because a low price makes a second paste feel cheap. You counter that habit by keeping the deny manifest beside the repository you intend to open. You also refuse to start a session when the exit code is dirty, even if the question feels urgent. You rotate any real credential that already touched a prompt, because closing a tab does not rewind a copy.

The report can be sensitive too, since a relative path may contain a customer name or a ticket identifier. You keep that report on your machine, and you do not paste it into the same session you are gating. A useful analogy is a boarding pass: the pass lists the gate, but you do not hand over the house keys with it. Carry the question, leave the evidence, and let the foreign room answer only what the toy fixture supports.

If you want one practice pass, build the toy tree, run the checker, and only then open a remote session. A free server is a reasonable rehearsal space when the bag is synthetic and the policy still matches your notes. Leave the key ring on the hook inside the house, where the courier cannot casually lift it. That method stays useful even if you later choose a different host for the same dry run.

Gate the Context Pack Before It Leaves

Riley Lin — Thu, 08 Oct 2026 10:26:34 +0000

You should refuse a hosted model call until a local gate marks the context pack clean. A free server is still a machine you do not administer, so the redaction has to finish on your laptop. The pack is the real transfer, not the short question you type into the box at the end. If the pack holds a secret, a customer trace, or an internal hostname, the question is already too late.

Think of the pack as a courier envelope that an assistant stuffs before you read the label. Your laptop is the first zone, the hosted server is the second zone, and the model path is the third. You can trust zone one with the raw files, because those files already live on a disk you control. You should assume that zone two and zone three keep copies you cannot delete on demand.

A modern coding assistant does not send only the sentence you wrote in the chat box. It often attaches the git diff, the open buffers, a slice of terminal scrollback, and a file tree summary. Each attachment looks harmless alone, yet together they reconstruct a private change that you never meant to publish. That reconstruction is why a tidy chat line can still leak a change you would not put in a public gist.

October pulls many of you into unfamiliar repositories, sample apps, and half-finished branches that you did not write. The temptation is to hand the whole tree to a hosted model and ask for a review before you understand the history. That habit fails when the tree holds a forgotten env file, a vendor token, or a comment that names an internal host. You need a local gate that runs before the assistant is allowed to leave zone one with that tree.

The workflow is small enough to run in a spare terminal before you open the assistant. You export a context pack with commands you already trust, then you scan that directory with a local script. You may send the directory only when the script exits clean, and you scan again after every edit. You do not negotiate with the gate by pasting a flagged span into chat to ask what it means.

Start from a temporary directory that you can delete without touching the working tree of the repository. The commands below copy the diff, a name-only status list, and a short log into that directory. They skip your shell history, your SSH agent, and a full environment dump, because those sources are too wide for a first gate. You may add a file later, but you add it by name rather than with a wildcard over your home directory.

mkdir -p /tmp/context-pack
git diff -- . ':!*.env' ':!.env*' > /tmp/context-pack/diff.patch
git status --short > /tmp/context-pack/status.txt
git log -5 --pretty=format:'%h %s' > /tmp/context-pack/recent-commits.txt
printf '%s\n' 'Review this public refactor only.' > /tmp/context-pack/ask.txt

Treat the export lines as a starting recipe, and adjust the pathspec if your git build rejects the exclusion syntax. The important constraint is the same on every version: you choose files by name, and you never dump the environment into the pack. If a command fails, you stop and read the error locally instead of pasting the error into a hosted chat. A failed export is still zone one, and it should stay there until you understand what the tool printed.

The scanner is a proposal you can run locally, not a certified data-loss product and not a result from a hosted lab. It walks the pack, applies a short set of patterns, and writes a JSON decision next to an exit code your shell can read. A match blocks the send even when the match sits inside a comment, a fixture, or a commit subject. Silence is not a proof of safety, because a regex cannot see a secret that uses a format you forgot to describe.

#!/usr/bin/env python3
"""Local gate for a context pack. Example only; extend the patterns for your org."""

import json
import re
import sys
from pathlib import Path

PATTERNS = {
    "aws_access_key": re.compile(r"AKIA[0-9A-Z]{16}"),
    "github_token": re.compile(r"gh[pousr]_[A-Za-z0-9]{20,}"),
    "slack_token": re.compile(r"xox[baprs]-[A-Za-z0-9-]{10,}"),
    "private_key": re.compile(r"-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----"),
    "bearer": re.compile(r"(?i)authorization:\s*bearer\s+[A-Za-z0-9._\-]{8,}"),
    "conn_string": re.compile(r"(?i)(?:postgres|mysql|mongodb|redis)://\S+:\S+@"),
    "internal_host": re.compile(r"\b(?:[a-z0-9-]+\.)+(?:internal|local|corp)\b"),
}

def scan(pack: Path) -> dict:
    findings = []
    files = sorted(path for path in pack.rglob("*") if path.is_file())
    for path in files:
        text = path.read_text(encoding="utf-8", errors="replace")
        for name, pattern in PATTERNS.items():
            for match in pattern.finditer(text):
                line = text.count("\n", 0, match.start()) + 1
                findings.append(
                    {
                        "rule": name,
                        "file": str(path.relative_to(pack)),
                        "line": line,
                    }
                )
    decision = "block" if findings else "allow"
    return {
        "decision": decision,
        "finding_count": len(findings),
        "findings": findings,
    }

def main() -> int:
    if len(sys.argv) != 2:
        print("usage: gate_context_pack.py PACK_DIR", file=sys.stderr)
        return 1
    pack = Path(sys.argv[1])
    if not pack.is_dir():
        print("pack directory not found", file=sys.stderr)
        return 1
    report = scan(pack)
    print(json.dumps(report, indent=2))
    return 2 if report["decision"] == "block" else 0

if __name__ == "__main__":
    raise SystemExit(main())

Save the script as gate_context_pack.py and point it at the temporary pack before you copy anything toward a server. A clean pack exits zero and prints an allow decision, which is the only result that may leave the laptop. You can prove the block path with a throwaway file that contains a published documentation key prefix, then delete that file and scan again. Keep the fake value obvious, and never seed the test with a token that has ever been real.

python3 gate_context_pack.py /tmp/context-pack
echo $?

# AKIAIOSFODNN7EXAMPLE is a widely published AWS documentation sample, not a live key.
printf '%s\n' 'aws_key=AKIAIOSFODNN7EXAMPLE' > /tmp/context-pack/bad-fixture.txt
python3 gate_context_pack.py /tmp/context-pack
echo $?

rm /tmp/context-pack/bad-fixture.txt
python3 gate_context_pack.py /tmp/context-pack

Read the JSON as a boarding pass rather than as a score you can talk your way past. An allow decision means the listed patterns did not fire, not that the pack is wise to share. A block decision names the file and the line, and it omits the matched text on purpose. You fix the source, you rebuild the pack, and you accept a fresh allow before any network call.

You can rehearse the whole path on a throwaway git repository that contains only a README and a one-line change. Create it under /tmp, run the export commands, and confirm an allow before you add the documentation-sample key. Remove the bad file, confirm that the allow returns, and only then consider a hosted call on that toy tree. That loop is the artifact, and you can repeat it on any branch without sending the branch anywhere first.

Once the gate allows the pack, you still choose where the bytes go, and that choice is the rest of the trust model. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open source coding assistant, and its stated offer includes a ten million token allowance on free model access. The same offer includes a free server option, which is still zone two unless you run the project on hardware you administer.

Use the free server when the pack came from a public repository, a tutorial you authored, or a redacted diff the gate allowed twice. Use a self-hosted checkout when the work names customers, unreleased fixes, or hostnames you would not put in a public issue. The free token allowance can cover a long review of a clean pack, but an allowance is not a privacy control. Confirm the current terms before you plan a week around them, because offers change and this article does not measure quota live.

Do not send environment dumps, shell history, crash dumps, customer tickets, or raw terminal scrollback even after you trim them. Do not send a file because its name looks boring, since status files and commit subjects often carry internal URLs. Do not send the gate report from a blocked run, because the path and the line can lead you back to the secret. Do not send someone else's private repository just because a hosted model feels convenient during a contribution sprint.

This approach fails closed only for the patterns you wrote down, and it fails open for everything else. A renamed token, a split secret, a business rule in plain prose, or an unpatched flaw will all pass a happy regex. The script does not encrypt the pack, it does not wipe editor swap files, and it does not stop another plugin channel. You should treat a plugin that auto-attaches open files as outside this gate until you disable that behavior.

You should not use this workflow for incident response, regulated records, payment data, or a repository under legal hold. You should not use the free server for code your employer has marked internal, even when the scanner stays quiet. A student on a public sample can adopt the gate as a habit, while a regulated team needs a control its counsel already accepts. If you cannot explain where zone two stores prompts, you are not ready to send the pack at all.

If your pack is already clean, the stated free server is enough to rehearse a public review without standing up hardware first. Stop if the terms you see no longer match this article, and do not treat a token allowance as a retention promise. The useful outcome is a reflex that checks the envelope before the courier leaves, not a longer chat with a model. Leave the private tree on the laptop until you can run the open source stack inside a zone you administer.

Ship a Scrubbed Mirror, Not Your Working Tree

Riley Lin — Thu, 08 Oct 2026 08:09:51 +0000

You should never place your everyday working tree on a free remote coding server, because that tree is a suitcase, not a clean source drop. The chat box is only the label on the suitcase, while the checkout underneath still carries remotes, ignored files, and local notes. If a model or a helper process can read the directory, you have already shared whatever the directory still holds. Start from that boundary, and only then decide which files a scrubbed mirror is allowed to contain.

A borrowed desk in a shared office is a useful picture for the choice you are about to make. You would not unpack your whole backpack onto that desk just because the desk is free for the afternoon. You would take out the one notebook page the task actually needs, and you would leave the house keys in your bag. A remote coding server works the same way, even when the invoice is zero and the model calls are included.

Your working tree is packed for you, not for a stranger's process that you do not administer. Git still remembers remote URLs, and some of those URLs embed a token or a username that should never leave your machine. Files you gitignored on purpose, such as env files and local databases, stay readable by any tool you point at the folder. Editor swap files, IDE folders, and stray notes beside the code still travel if you copy the directory as it sits.

Uncommitted diffs are a quieter problem, because a deleted line can still hold a password you thought you had already removed. That leak is different from typing a secret into a prompt, and it is different from pasting a log into a chat window. Those mistakes happen in the message you compose, while this mistake happens before you type, when the server receives a checkout. You can write a careful prompt and still fail, if the agent may list the directory, open git config, or search ignored files.

Treat the directory listing as the real request, and treat the prompt as a comment written beside that request. Build the mirror on your own machine, before any remote process is allowed to exist at all. If the task depends on an uncommitted patch, review that diff locally and copy only hunks that survive the same gate. Do not use your normal clone as the source of that copy, because a normal clone keeps the remote URL and the object store.

A tracked-file archive gives you source text without the old remote configuration, because the archive does not include the git directory. An archive of HEAD is narrower than a folder copy, because ignored files and untracked notes stay behind on the laptop. Confirm that difference with git status showing ignored files before you treat the mirror as complete. You still need the gate, because tracked files themselves can hold a token that a careful commit should never have stored.

The gate below is an unexecuted example you can save as bundle_gate.py and run locally before any upload. It is a teaching gate, not a certified scanner, and it will miss secret formats it has never been shown. Extend the patterns for names your team actually uses, and keep the file outside any bundle you plan to scan. Run it on a fixture that must fail, and run it again on the mirror that must pass, before you copy anything.

#!/usr/bin/env python3
'''Example gate: refuse a context bundle that still looks like a laptop tree.
Not executed in this article. Extend patterns for your own naming scheme.
'''
import re, sys
from pathlib import Path

HOT = re.compile(
    r'(?i)(api[_-]?key|secret|password|token|BEGIN (RSA |OPENSSH )?PRIVATE KEY)'
)
REMOTE_TOKEN = re.compile(r'https?://[^ /:]+:[^ /@]+@')
SKIP = {'.git', 'node_modules', 'venv', '.venv', 'dist'}

def walk(root: Path):
    findings = []
    for path in root.rglob('*'):
        if any(part in SKIP for part in path.parts):
            continue
        if path.name in {'.env', '.env.local', 'id_rsa', 'id_ed25519'}:
            findings.append(f'blocked name: {path}')
            continue
        if not path.is_file() or path.stat().st_size > 1_000_000:
            continue
        try:
            text = path.read_text(encoding='utf-8', errors='ignore')
        except OSError:
            continue
        if HOT.search(text) or REMOTE_TOKEN.search(text):
            findings.append(f'blocked text: {path}')
    return findings

if __name__ == '__main__':
    root = Path(sys.argv[1] if len(sys.argv) > 1 else '.')
    hits = walk(root)
    if hits:
        print(chr(10).join(hits))
        sys.exit(1)
    print(f'bundle ok: {root}')

Pair that script with a short command sequence you run in a scratch directory, not inside the original repository. The first command lists remote URLs so you can see a token before anything moves off the laptop. The next commands build a tracked-only archive, unpack it with no remote, and stage a separate fixture that must fail. Keep the gate script outside both folders, because the script itself contains the words it is trying to catch.

# Unexecuted example. Fixture must fail; mirror must pass.
# Keep bundle_gate.py outside both directories.
SRC="${SRC:-$HOME/src/your-repo}"
MIRROR="${MIRROR:-$HOME/tmp/scrubbed-mirror}"
FIXTURE="${FIXTURE:-$HOME/tmp/gate-fixture}"
rm -rf "$MIRROR" "$FIXTURE"
mkdir -p "$MIRROR" "$FIXTURE"
git -C "$SRC" config --get-regexp 'remote\..*\.url'
git -C "$SRC" status --ignored --short
git -C "$SRC" archive --format=tar HEAD | tar -x -C "$MIRROR"
echo 'API_TOKEN=fixture-not-real' > "$FIXTURE/.env"
python3 bundle_gate.py "$FIXTURE"; echo "fixture exit:$?"
python3 bundle_gate.py "$MIRROR"; echo "mirror exit:$?"

Read the gate output as a decision, not as a suggestion you can override because the afternoon is already short. A blocked name means that file stays on your laptop, even if you believe the value inside it is stale. A blocked text hit means you open the file locally, replace the value with a fixture, and run the gate again. Only a clean exit is permission to copy the mirror onto remote compute, and bargaining with that result means you stop.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode's free model access and free server option matter here only as a place to practice that gate on a scrubbed mirror. Do not treat those options as a stated quota, a hardware shape, a retention window, or a promise that the free tier stays fixed. Those details belong in the current product documentation, which you should read before you rely on either option.

Use the free server as a second pair of eyes on the mirror, not as a vault for the original checkout. Point the model at the scrubbed tree and ask it to explain a failing test or to draft a patch against fixture data. Ask it, in the same session, to list any file that still looks like a secret, and compare that list with your gate. Do not rely on the model to notice that a checkout is sensitive, because refusal is not a control you can audit.

If the model finds a miss or invents a hit, fix or tune the script before you trust it on the next mirror. Keep a small fixture repo whose only job is to prove the gate still fails closed when a fake secret appears. Put a fake token in a comment, a fake remote URL in a sample config, and a dot-env file that must fail. Run the gate on that fixture and require a nonzero exit, then run it on the real mirror and require a zero exit.

That pair of results is the artifact you can show a teammate, and it does not depend on any vendor remaining free. This approach is the wrong tool when the tree holds customer records, payment data, health data, or other regulated material. A regex gate will miss a split secret or a binary, and it will also flag the plain word token in a comment. A depth-limited archive also drops history on purpose, so do not fix that gap by uploading the full object store instead.

If your task needs production credentials in order to run, a free remote server is the wrong place to run that task. You should also skip this workflow when you cannot name the trust boundary in one plain sentence. If you do not know who operates the server, where logs go, or whether a human can open the workspace, keep the mirror local. Free access is a budget fact, not a security review, and a missing review is a reason to wait.

Practicing the gate on a laptop, with no network call at all, is still a useful afternoon when the remote path is unclear. When the boundary is clear and the tree is dull on purpose, the free options are a reasonable classroom for the habit. Build the mirror, fail the fixture, pass the scrub, and only then open the remote box against that dull tree. If you already use MonkeyCode, rehearse that sequence on a throwaway repo before the free server sees a real tree.

Stop the Send When a Log Field Is Still Hot

Riley Lin — Thu, 24 Sep 2026 21:14:14 +0000

You should treat every log line as a packed envelope, because a model receives each field you forgot to strip before the question. A stack trace looks like a harmless debugging aid, yet it often carries hostnames, query fragments, and headers never written for a stranger. If one field inside that line is still hot, you should stop the entire send, even when the surrounding text looks dull and operational. That standard is stricter than a vague caution, and it is the only standard that still holds on a tired incident afternoon.

Picture the trust boundary as a doorway rather than as the chat box where you type the question. The doorway is the moment those bytes are copied into a request, a ticket, or a file uploaded for an outside explanation. Before that copy happens, the log still sits in a collector you administer, and you can still delete a field without negotiating with anyone. After the copy, you are asking another process to remember a slice of your system, and a later edit cannot pull that field back.

Hot fields hide inside ordinary lines, which is why a quick visual scan so often misses them during an incident. A debug logger may print an Authorization header because someone left verbose middleware enabled while chasing a timeout. An exception message may embed a database URL because the driver helpfully printed the target it could not reach. A user email may sit in a template variable that an error formatter treated as harmless context rather than as personal data.

Identifiers deserve the same suspicion you already give to passwords, because they join records that were never meant to meet. A request identifier can connect a public paste to an internal trace when both sides preserve the same value. An internal address beside a service name sketches how your network is wired, even when no password appears on the line. A file path can reveal a home directory, a tenant name, or a deploy layout you would not publish in a status note.

The practical move is a local gate that classifies each field before any model is allowed to see the file. You run that gate on the machine holding the log, then you forward only the redacted copy after reading the blocked key report. The gate works as a speed bump rather than a compliance certificate, making the dangerous send harder than the safe one.

The script below is a proposed local check, and it is not a record of a run inside your environment or a certified control. It reads JSON lines, refuses keys you name, and masks values that look like tokens, mail addresses, or connection strings. You should extend the patterns for your own stack, and you should keep the raw file off every request path.

#!/usr/bin/env python3
'''Proposed local gate. Not a certified control. Synthetic fixtures only.'''
import json
import sys
from pathlib import Path

HOT_KEYS = {
    'authorization', 'cookie', 'set-cookie', 'password',
    'secret', 'api_key', 'access_token', 'refresh_token',
    'connection_string', 'private_key',
}

def has_email(text):
    cleaned = text.replace(',', ' ').replace(';', ' ')
    for token in cleaned.split():
        if token.count('@') != 1:
            continue
        local, domain = token.split('@')
        if local and '.' in domain and ':' not in local:
            return True
    return False

def has_bearer(text):
    return 'Bearer ' in text

def has_url_password(text):
    start = text.find('://')
    if start < 0:
        return False
    at = text.find('@', start + 3)
    if at < 0:
        return False
    return ':' in text[start + 3:at]

def has_private_key(text):
    return '-----BEGIN ' in text and 'PRIVATE KEY-----' in text

def classify(key, value):
    reasons = []
    if str(key).lower() in HOT_KEYS:
        reasons.append('hot_key')
    text = value if isinstance(value, str) else json.dumps(value)
    if has_email(text):
        reasons.append('email')
    if has_bearer(text):
        reasons.append('bearer')
    if has_url_password(text):
        reasons.append('url_secret')
    if has_private_key(text):
        reasons.append('private_key')
    return reasons

def redact(record):
    blocked = []
    clean = {}
    for key, value in record.items():
        reasons = classify(key, value)
        if reasons:
            blocked.append({'key': key, 'reasons': reasons})
            clean[key] = '[REDACTED]'
        else:
            clean[key] = value
    return clean, blocked

def main():
    src, dst, report_path = map(Path, sys.argv[1:4])
    findings = []
    with src.open() as incoming, dst.open('w') as outgoing:
        for index, line in enumerate(incoming, 1):
            clean, blocked = redact(json.loads(line))
            if blocked:
                findings.append({'line': index, 'blocked': blocked})
            outgoing.write(json.dumps(clean) + '\n')
    report_path.write_text(json.dumps(findings, indent=2))
    # Exit 2 means the send stays stopped until a human reviews the report.
    sys.exit(2 if findings else 0)

if __name__ == '__main__':
    main()

A matching fixture keeps the lesson concrete without placing a live secret into an article or a shared channel. Save the two lines below as sample.jsonl; a correct run of this proposed gate should exit nonzero, since both lines still carry heat. The first line would survive a key-only denylist, because the hot value sits in msg rather than in a field named password. The second line hides a user email and a database URL that includes a password in the userinfo section.

{"level":"error","msg":"upstream rejected Bearer EXAMPLE.not.a.real.token","service":"billing"}
{"level":"error","user":"ada@example.com","msg":"connect failed postgres://app:example-pass@db.internal:5432/app"}

You run the gate from the shell, you print the status, and you inspect the report before any paste leaves the machine. A nonzero status is the intended signal rather than a broken tool, because it means at least one field was still hot. The redacted file is then the only candidate for a later question, and even that candidate deserves a human glance before it moves. If the report names a key you need, swap that value for a fake label like tenant T1 instead of restoring it.

python3 redact_gate.py sample.jsonl redacted.jsonl report.json
echo gate_status=$?
python3 -m json.tool report.json

What you withhold is broader than passwords, because the model may carry a labeled box but not the contents of your desk. You should not send raw authorization headers, session cookies, recovery codes, connection strings, or private key blocks, even when they sit inside an exception. You should not send production request bodies, because a body can hold a card number or a note that no pattern list anticipated. You should not send an unredacted trace, because one hot field can repeat across services and make the leak wider than a single line.

Free capacity does not shrink that list, yet a clean report can justify a narrower question about the redacted file alone. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option you can try for that redacted file, provided you never upload the raw log. Those are availability claims only, with no quota, hardware, duration, or permanence stated here, and a free server stays outside your boundary.

You should skip this approach when the data is regulated and must not leave your network even after a redaction pass. You should not treat the script as a substitute for a reviewed data-loss product, a signed vendor agreement, or a secrets manager. You should not point the script at a live production stream and treat a clean exit as proof that nothing sensitive remains. Regular expressions miss new formats and custom names, so a green status is a hint rather than a warranty for an auditor.

If the incident truly requires the raw secret in order to proceed, you rotate that secret instead of teaching it to any model. The habit is small enough for a busy week: classify the line, keep the raw file local, and ask only about a clean copy. When the report is empty, a remote explanation of that copy is optional, and when the report is not empty, the send stays stopped.

A Secret in the Prompt Is Already Shared

Riley Lin — Wed, 23 Sep 2026 17:07:06 +0000

If a secret reaches a remote model, treat that secret as copied, retained, and no longer yours. You cannot recall a context window the way you revoke a token after a leak. The practical move is to classify files before any assistant reads them, not after a worrying paste. This walkthrough maps trust boundaries around logs and secrets, then adds a local preflight gate.

Think of the assistant as a courier who photocopies every page you hand over at the door. Your laptop is building A, while the model and its logs live across town in building B. Trust stops at the process that builds the prompt, because later hops follow someone else's retention. You should decide what may cross that door while the files still sit quietly on disk.

A workable picture of the path has four rooms, and each room keeps a different kind of memory. The workspace holds source, environment files, crash dumps, and shell history you never filed as documentation. The client then gathers those bytes into a prompt, a tool trace, or an attachment that looks routine. Remote inference parses the payload, after which operator logs and support tooling may keep another durable copy.

You already avoid dumping raw private keys, yet the risky files usually look like ordinary engineering work. Application logs reprint authorization headers after a failed request, long after the original incident feels closed. Test fixtures replay production payloads with real customer identifiers because someone needed a failing case to pass. Heap dumps and profiler output embed connection strings simply because the process still had them in memory.

Transcript files from yesterday's debugging session are delayed pastes waiting for the next seemingly innocent model call. Continuous integration artifacts often stitch together secrets, branch names, and internal hostnames in a single text blob. Editor swap files and forgotten debug.json dumps sit beside the code and get swept into "include the repo" habits. If you cannot explain why a file is safe to publish, it is not safe to place in a prompt.

Before you open an assistant on a repository, name the classes of data that must never leave the machine. Credentials and tokens form the first class, including cloud keys, session cookies, and private signing material. Personal and customer data form the second class, even when they appear inside a failing unit test. Operational residue is the third class, covering logs, core files, environment files, and anything stored under SSH directories.

A fourth class is contractual or regulated text that your company already forbids sending to any outside vendor. The question's cleverness does not change that classification, because the model cannot unlearn a paragraph later. Keep the matrix below next to the repository as a preflight check, not as a substitute for legal review.

Data class	Typical location	Cross the remote boundary?
Credentials and signing material	`.env`, `*.pem`, CI variables, cloud key files	Never
Customer or staff records	fixtures, CSV exports, ticket dumps	Never
Operational residue	`logs/`, crash dumps, shell history, `.ssh/`	Not until a human redacts it
Ordinary source without secrets	`src/`, public docs, tests with fake data	Maybe, after the local gate
Counsel-flagged or regulated text	anything already under a legal hold	Never

The gate below is a proposed local filter, not a certified control, so treat every finding as advisory guidance. It walks a tree, skips deny-name patterns, scans remaining text for key-shaped tokens, and writes two artifacts. One artifact is a redacted question file you might later send if the remaining problem is still answerable. The other artifact is an audit of what would have crossed the boundary if you had shared the tree blindly.

#!/usr/bin/env python3
"""Proposed preflight gate. Advisory only. Not a compliance control."""
from __future__ import annotations

import argparse
import re
import sys
from pathlib import Path

DENY_NAMES = {
    ".env",
    ".env.local",
    ".env.production",
    "id_rsa",
    "id_ed25519",
    "credentials.json",
    "service-account.json",
}
DENY_SUFFIXES = {".pem", ".p12", ".pfx", ".key", ".kdbx"}
DENY_PARTS = {"secrets", ".ssh", "kube", "terraform.tfstate"}
SKIP_DIRS = {".git", "node_modules", "dist", "build", ".venv", "__pycache__"}

KEY_SHAPED = re.compile(
    r"(?i)(api[_-]?key|secret|token|password|authorization|bearer)\s*[:=]\s*\S+"
)
PEM_BLOCK = re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----")


def denied_path(path: Path) -> str | None:
    name = path.name.lower()
    if name in DENY_NAMES or path.suffix.lower() in DENY_SUFFIXES:
        return "deny-name"
    for part in path.parts:
        if part.lower() in DENY_PARTS:
            return "deny-path"
    return None


def scan_text(text: str) -> list[str]:
    hits: list[str] = []
    if PEM_BLOCK.search(text):
        hits.append("pem-block")
    if KEY_SHAPED.search(text):
        hits.append("key-shaped-assignment")
    return hits


def redact_line(line: str) -> str:
    line = PEM_BLOCK.sub("[REDACTED_PEM]", line)
    return KEY_SHAPED.sub(lambda m: m.group(1) + "=[REDACTED]", line)


def iter_files(root: Path):
    for path in root.rglob("*"):
        if not path.is_file():
            continue
        if any(part in SKIP_DIRS for part in path.parts):
            continue
        yield path


def main() -> int:
    parser = argparse.ArgumentParser(description="Proposed workspace preflight gate")
    parser.add_argument("root", type=Path)
    parser.add_argument("--out", type=Path, required=True)
    args = parser.parse_args()
    root = args.root.resolve()
    out = args.out
    out.mkdir(parents=True, exist_ok=True)

    audit_lines: list[str] = []
    clean_chunks: list[str] = []
    blocked = 0

    for path in iter_files(root):
        rel = path.relative_to(root)
        reason = denied_path(path)
        if reason:
            blocked += 1
            audit_lines.append(f"BLOCK {rel} ({reason})")
            continue
        try:
            text = path.read_text(encoding="utf-8")
        except UnicodeDecodeError:
            audit_lines.append(f"SKIP {rel} (binary)")
            continue
        hits = scan_text(text)
        if hits:
            blocked += 1
            audit_lines.append(f"BLOCK {rel} ({','.join(hits)})")
            continue
        redacted = "\n".join(redact_line(line) for line in text.splitlines())
        clean_chunks.append(f"# FILE {rel}\n{redacted}\n")
        audit_lines.append(f"ALLOW {rel}")

    (out / "audit.txt").write_text("\n".join(audit_lines) + "\n", encoding="utf-8")
    (out / "question.txt").write_text(
        "Answer from the allowed files only. Do not ask me to paste blocked paths.\n\n"
        + "\n".join(clean_chunks),
        encoding="utf-8",
    )
    print(f"wrote {out}/audit.txt and {out}/question.txt")
    print(f"blocked={blocked}")
    return 1 if blocked else 0


if __name__ == "__main__":
    sys.exit(main())

Run the script from the repository root so relative paths in the audit match the files you almost shared. A non-zero exit means the script believes something sensitive still sits inside the candidate set you nearly exported. Read the audit before you negotiate with the findings, because deleting evidence is not the same as reducing risk.

python3 context_gate.py . --out /tmp/assistant-preflight
echo "exit=$?"
sed -n '1,40p' /tmp/assistant-preflight/audit.txt
wc -l /tmp/assistant-preflight/question.txt

You can tighten the deny names for your stack without pretending the script is a general secret scanning product. Teams that keep Terraform state, Kubernetes secret manifests, or dumped JWTs in scratch folders should add those paths. The default should remain "do not send" unless a file earns a place in a short, reviewed allow set. An allow set that includes src/ and docs/ is easier to defend than a deny set you update under pressure.

Command output from the assistant is another doorway for the same classes, so keep a gate on the way back. If you let a tool run environment dumps, git diffs against production config, or shell history, the trust boundary expands immediately. A safer pattern wraps risky commands with an allowlist, then forwards only truncated standard output into later prompts. The snippet below is an example you must adapt; it is not a drop-in security product for mixed fleets.

#!/usr/bin/env bash
# Proposed command wrapper. Example only. Adapt before any real use.
set -euo pipefail
ALLOW_REGEX="${ALLOW_REGEX:-^(ls|pwd|git status|git log --oneline -5)$}"
cmd="$*"
if [[ ! "$cmd" =~ $ALLOW_REGEX ]]; then
  printf 'refusing command not in allowlist: %s\n' "$cmd" >&2
  exit 2
fi
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
bash -lc "$cmd" >"$tmp" 2>&1 || true
python3 - "$tmp" <<'PY'
from pathlib import Path
import re, sys
text = Path(sys.argv[1]).read_text(encoding="utf-8", errors="replace")
pat = re.compile(r"(?i)(api[_-]?key|secret|token|password|authorization)\s*[:=]\s*\S+")
for line in text.splitlines()[:80]:
    print(pat.sub(lambda m: m.group(1) + "=[REDACTED]", line)[:240])
PY

Notice that the wrapper refuses to forward lines that look like secret assignments, even when the command seemed boring. Treat the model like a journalist, and treat your shell like an unedited interview tape sitting on the table. You do not hand over the tape because a single question sounded technical and the deadline felt close. You hand over a transcript you already reviewed, with names, tokens, and internal hosts already taken out on purpose.

Once the gate writes a clean question file, you may still want a remote second opinion on the remaining puzzle. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode provides free model access and a free server option that can host that hop after local redaction is done. You can send the already cleaned question file there if a remote pass is still useful to you.

That does not make the remote side trusted; it only means you are sending already-sanitized text instead of the raw workspace. If your policy forbids any remote inference, stop at the audit file and keep the remaining work on the machine. A cleaned file can still overshare architecture details that your threat model never classified as a secret. Re-read the allow set with that in mind before any client process attaches the file to a remote request.

Limitations matter, because a regular-expression gate will miss secrets that refuse to look like secrets in isolation. A password in a comment, a customer name in a screenshot, or a token split across two lines will pass. Entropy checks punish legitimate long hashes in lockfiles and can lull you into deleting the wrong kind of evidence. Free remote capacity is still somebody else's machine with logs, and this workflow is not a confidential enclave.

You should not use this approach when you need a compliance boundary rather than a careful personal habit. Regulated workloads, air-gapped product code, and incident data from real users belong in tools your security team approved. Do not treat a blog script as a substitute for data loss prevention, a vendor review, or an internal model. If your question cannot be asked without the secret, change the system so the secret is no longer required.

The core conclusion stays simple when the assistant, the tools, and the logs all start talking at once. Classify first, redact second, and only then decide whether a remote model belongs anywhere in the loop. The context window will keep a copy of whatever you allow across that door, including jokes that contain tokens. Your deny list is the last control that still lives entirely on your side of the wall.

Tool Output Is a Second Prompt

Riley Lin — Tue, 22 Sep 2026 15:23:47 +0000

When a coding agent runs a command, the interesting leak is not the prompt you typed. The leak is the stdout that the tool ships back into the model context, often without anyone reading it first. You already treat prompts as data leaving the machine, yet stdout from grep and test runners still travels wide open. That return path is a second prompt, and it deserves the same trust-boundary review you give the first one.

You should think of the agent loop as an airport checkpoint rather than a casual chat box. You inspect the suitcase on the way to the gate, then ignore the trolley that comes back from the carousel. Command output is that trolley: it re-enters the sterile area carrying whatever the runway collected. Environment dumps, connection strings in stack traces, and customer identifiers in failing fixtures all ride that trolley.

If the model sits on a remote host, that trolley also leaves your building as ordinary HTTPS traffic. A free inference server does not change the physics of the copy; it only changes who operates the disk. You should draw the trust boundary at the wrapper around the tool, not at the vendor's landing page. Everything that wrapper emits is, for practical purposes, a document you chose to publish to the model.

Most agent tools look harmless because they resemble commands you already run in a terminal. Invocations such as env, git remote -v, docker inspect, and a failing pytest log are daily furniture in a debugging session. Furniture still has drawers, and those drawers often hold tokens, internal hostnames, and fragments of production records. The model did not steal those fragments; your tool loop handed them over as context that might help it see the failure.

Logs make the same mistake in slower motion, because request traces and assistant session files keep a second copy of every tool result. A platform that records prompts for review will also record the stdout you fed the model, including secrets you thought lived only in memory. You cannot unsend a log line after the model has already tokenized it. If you would not paste that line into a public issue tracker, you should not allow the tool loop to paste it either.

You can close the return path with a local filter that sits between subprocess and the model client. The filter is not encryption; it is a seatbelt that stops obvious secrets from becoming prompt tokens. The listing below is a proposed Python wrapper you can run on your own laptop. Treat it as a starting point for a threat model, not as a finished compliance program.

#!/usr/bin/env python3
"""Proposed local filter: redact tool stdout before any model client sees it."""

from __future__ import annotations

import argparse
import re
import subprocess
import sys
from typing import List, Tuple

# Policy sketch, not a complete deny list. Extend it from your own threat model.
HIGH_RISK_PREFIXES = (
    "env",
    "printenv",
    "docker inspect",
    "kubectl get secret",
    "aws secretsmanager",
    "git config --list",
    "curl http://169.254.169.254",
)

PATTERNS: List[Tuple[str, str]] = [
    (r"AKIA[0-9A-Z]{16}", "[REDACTED_AWS_KEY_ID]"),
    (r"(?i)aws_secret_access_key\s*=\s*\S+", "aws_secret_access_key=[REDACTED]"),
    (r"(?i)(api[_-]?key|token|secret|password|passwd)\s*[:=]\s*\S+", r"\1=[REDACTED]"),
    (
        r"-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----",
        "[REDACTED_PRIVATE_KEY]",
    ),
    (r"(?i)(postgres|mysql|mongodb|redis)://[^\s'\"']+", "[REDACTED_DB_URL]"),
    (r"(?i)bearer\s+[a-z0-9._\-]+", "Bearer [REDACTED]"),
    (r"[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}", "[REDACTED_EMAIL]"),
]

MAX_CHARS = 4000


def is_high_risk(command: str) -> bool:
    lowered = " ".join(command.split()).lower()
    return any(lowered.startswith(prefix) for prefix in HIGH_RISK_PREFIXES)


def redact(text: str) -> str:
    redacted = text
    for pattern, repl in PATTERNS:
        redacted = re.sub(pattern, repl, redacted, flags=re.DOTALL)
    if len(redacted) > MAX_CHARS:
        redacted = redacted[:MAX_CHARS] + "\n[TRUNCATED_TOOL_OUTPUT]"
    return redacted


def run_filtered(argv: List[str]) -> int:
    command_text = " ".join(argv)
    if is_high_risk(command_text):
        print("REFUSED: command matches a high-risk prefix.", file=sys.stderr)
        print("Describe the failure to the model instead of dumping the environment.", file=sys.stderr)
        return 2

    completed = subprocess.run(argv, capture_output=True, text=True, check=False)
    combined = (
        f"$ {command_text}\n"
        f"exit={completed.returncode}\n"
        f"stdout:\n{completed.stdout}\n"
        f"stderr:\n{completed.stderr}\n"
    )
    sys.stdout.write(redact(combined))
    return 0


def main() -> int:
    parser = argparse.ArgumentParser(
        description="Run a command and print a redacted transcript for a model."
    )
    parser.add_argument("command", nargs=argparse.REMAINDER)
    args = parser.parse_args()
    argv = args.command[1:] if args.command and args.command[0] == "--" else args.command
    if not argv:
        print("usage: tool_stdout_filter.py -- <command> [args...]", file=sys.stderr)
        return 1
    return run_filtered(argv)


if __name__ == "__main__":
    raise SystemExit(main())

Try the two invocations below against a scratch clone so you can compare the raw transcript with the filtered one. The env command should be refused by policy, which is the correct outcome for a floor sweep of process memory. The test command should return a truncated, placeholder-filled transcript that you can actually read before a model does. That reading step is the control; automation without a human glance will miss the pattern that regex did not know.

python tool_stdout_filter.py -- env
python tool_stdout_filter.py -- pytest -q tests/test_login.py

Classification belongs in the same wrapper, and it should be written as policy rather than as a vibe. Commands that print process environments, cloud metadata, kubernetes secrets, or docker configs are high risk even when you only wanted a version string. Commands that compile a single file or run unit tests on synthetic fixtures are lower risk after redaction, though they are never zero risk. You should keep this process on your side of the boundary, because a filter after the HTTP request has already lost.

The model only needs the shape of a failure, not the living credentials that happened to be in scope when the test process started. If the redacted output is no longer enough to debug the issue, you debug that issue locally instead of widening the pipe. A thinner packet is a successful security outcome even when it feels like a worse debugging experience.

After the wrapper reduces the transcript, you still need a destination if a remote model should reason about the failure. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode's free model access and free server option can receive an already-redacted transcript when you are experimenting on throwaway code rather than regulated records. Availability of a free remote path does not make the filter optional; it only gives you a place to send the leftover puzzle.

Limitations need to stay in view, because regex is a blunt instrument and models are hungry for context. Encoded secrets, novel token formats, screenshots, and binary files will walk around this wrapper without triggering a match. A determined agent allowed to read arbitrary paths can still open private keys and return a paraphrase that reconstructs the secret. You should deny file-read tools against known secret locations, and you should never treat a successful redaction log as evidence that nothing left.

This approach is the wrong tool if you handle data that cannot touch a third-party model at all. Healthcare records, payment cards, and customer exports belong in an air-gapped workflow, not in a filter in front of a free server. It is also the wrong tool if you need a cryptographic guarantee, because a placeholder in stdout is not a vault. Teams with a private on-metal model should still filter tool output and should not replace that path with a public endpoint.

The durable habit is small, slightly inconvenient, and easier to keep than an incident review. You let the agent propose a command, run it through your filter, and send only residue that belongs on a whiteboard. Tool output is a second prompt, and those second prompts are how quiet incidents usually start. If you want to see how small a sanitized packet can get, try the wrapper on a throwaway repo first.

Treat Remote Inference as Untrusted Egress

Riley Lin — Mon, 21 Sep 2026 13:43:13 +0000

You should treat every remote coding-model request as data leaving a trust boundary you control. The editor window still looks like a local tool, so stack traces, env files, and customer ids travel with the prompt. A small preflight scan on the bundle you are about to send will stop more leaks than another reminder to be careful.

A coding assistant spans several networks even when the interface is only a sidebar in your editor. Your buffer and language server stay on the laptop, while completion, chat, or agent steps often run remotely. Retries, provider logs, and support traces may persist after the answer returns to your screen. That means the real trust boundary is the outbound request, not the tab that rendered the reply.

Picture the workspace as a sealed workshop and the remote model as a loading dock at the curb. You can roll a cart to that dock, but you do not owe the dock every drawer in the shop. Once a crate sits on the truck, you cannot retrieve one bolt because you later disliked the label. Classification therefore happens before packaging, not after the model has already seen the file.

The dangerous payload is rarely a password you typed into the chat box on purpose. It is the kubeconfig that the agent indexed, or the HAR file you attached to explain a timeout. It is the JWT printed in a failing test, or the customer email sitting in a fixture named happy_path.json. Those objects feel like debugging texture, yet they are live credentials and personal data under another name.

You can make the boundary visible by building a context manifest before any remote call leaves the machine. The manifest lists paths and matched secret patterns, then refuses to proceed when matches remain in the tree. The script below is a labeled proposal you can run locally; it is not a substitute for vendor DLP. Keep the report next to the bundle so later readers can see what you believed was safe to send.

#!/usr/bin/env python3
"""Proposal: refuse to ship workspace context that still matches secret-like patterns."""
from __future__ import annotations

import argparse
import re
import sys
from pathlib import Path

PATTERNS = [
    ("aws_access_key", re.compile(r"AKIA[0-9A-Z]{16}")),
    ("pem_private_key", re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----")),
    ("bearer_token", re.compile(r"(?i)bearer\s+[A-Za-z0-9._\-]+={0,2}")),
    (
        "generic_secret_assign",
        re.compile(
            r"(?i)(api[_-]?key|secret|token|password)\s*[:=]\s*['\"][^'\"]{8,}['\"]"
        ),
    ),
    ("connection_string", re.compile(r"(?i)(postgres|mysql|mongodb(\+srv)?)://[^\s'\"]+")),
    (
        "email_shaped",
        re.compile(r"[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}"),
    ),
]

SKIP_DIRS = {".git", "node_modules", "dist", ".venv", "__pycache__"}
TEXT_SUFFIXES = {
    ".py", ".js", ".ts", ".tsx", ".json", ".yml", ".yaml",
    ".env", ".md", ".txt", ".log", ".http", ".toml", ".har",
}


def iter_files(root: Path):
    for path in root.rglob("*"):
        if not path.is_file():
            continue
        if any(part in SKIP_DIRS for part in path.parts):
            continue
        if path.suffix.lower() not in TEXT_SUFFIXES and path.name not in {".env", ".env.local"}:
            continue
        yield path


def scan(root: Path, allow_emails: bool) -> list[tuple[str, str, int, str]]:
    hits: list[tuple[str, str, int, str]] = []
    for path in iter_files(root):
        try:
            text = path.read_text(encoding="utf-8", errors="replace")
        except OSError:
            continue
        for name, pattern in PATTERNS:
            if name == "email_shaped" and allow_emails:
                continue
            for line_no, line in enumerate(text.splitlines(), start=1):
                if pattern.search(line):
                    hits.append((str(path), name, line_no, line.strip()[:120]))
    return hits


def main() -> int:
    parser = argparse.ArgumentParser(description="Scan a context directory before remote inference.")
    parser.add_argument("root", type=Path, help="Directory you plan to send or attach")
    parser.add_argument("--allow-emails", action="store_true")
    parser.add_argument("--report", type=Path, default=Path("context-egress-report.txt"))
    args = parser.parse_args()
    root = args.root.resolve()
    if not root.is_dir():
        print(f"not a directory: {root}", file=sys.stderr)
        return 2
    hits = scan(root, allow_emails=args.allow_emails)
    lines = [f"root={root}", f"hits={len(hits)}"]
    for path, name, line_no, snippet in hits:
        lines.append(f"{path}:{line_no}:{name}:{snippet}")
    args.report.write_text("\n".join(lines) + "\n", encoding="utf-8")
    print(f"wrote {args.report} with {len(hits)} hit(s)")
    return 1 if hits else 0


if __name__ == "__main__":
    raise SystemExit(main())

Save that file as preflight_context.py and point it at the directory you would otherwise zip for an assistant. A non-zero exit code means you still have pattern hits, so you should redact or drop those paths first. The email rule is noisy on purpose, because fixtures often hide production identities inside supposedly fake data. If your sample data is synthetic and documented, you can pass --allow-emails without pretending the other rules are optional.

python3 preflight_context.py ./context-bundle
echo $?
# 0 means this gate found no pattern hits in the tree you named.

That command writes context-egress-report.txt beside your bundle so the decision is an artifact, not a memory. You should commit the report only when it contains no live secrets, because the report reprints matched lines. Treat a hit on a private key or connection string as a failed ship, not as a style warning to ignore. If the gate is clean, copy allowed files into a staging directory and send only that staging tree downstream.

# Proposal: copy only allowlisted paths after a clean preflight.
set -euo pipefail
SRC="./app"
STAGE="./context-stage"
rm -rf "$STAGE"
python3 preflight_context.py "$SRC"
mkdir -p "$STAGE"
# Keep the failing module and its test; leave env files, kubeconfig, and dumps behind.
cp "$SRC/src/billing.py" "$STAGE/"
cp "$SRC/tests/test_billing.py" "$STAGE/"
python3 preflight_context.py "$STAGE"

The snippet above is labeled as a proposal because your allowlist will differ, and copying the whole source tree often reintroduces secrets. Notice the second preflight on the staging directory; a clean scan of the repo root is not a scan of what you send. A path you forgot to copy cannot leak, which is a better default than hoping a giant archive was harmless.

After the staging tree is clean, you still need a model to rewrite tests, explain a stack, or sketch a patch. MonkeyCode provides free model access and a free server option for that mechanical step once the bundle is already redacted. Disclosure: This article was prepared as part of MonkeyCode's product outreach. You still run the preflight on your side, then send the smallest staging tree that can answer the question.

Free hosting does not move the trust boundary back onto your laptop, and it does not erase provider logs. If a later agent mode re-reads the full repository, you must run the same gate against that larger tree too. Logs on a free server are still logs, so you should not treat cost as a privacy control. The model can be useful while remaining firmly on the untrusted side of the dock.

This approach fails closed on regular expressions, which means novel secret formats and obfuscated values will sail through. It also fails open if you point the scanner at a tiny subdirectory while the agent later indexes the whole repository. Do not use this gate as your only control when you handle health data, payments, or government identifiers. Air-gapped teams, and anyone contractually barred from third-party inference, should not send a staging tree at all.

The workflow fits individual developers who already paste context into assistants and want a repeatable stop before egress. It also fits small teams that can agree on a staging folder and keep production dumps off developer laptops. It does not fit a compliance program that needs attested deletion, regional residency, or a signed subprocessors list. Those programs need contracts and architecture, not a Python file that prints interesting lines from disk.

Draw the inference boundary in the same place you draw other egress: before the bytes leave the host. If you try the preflight on a real fixture directory, you will usually find at least one email or token. Redact that hit, rebuild the staging tree, and only then ask the remote model to work on what remains. Keep the model on the far side of the dock, and keep the keys in the workshop where they started.

The Debug Paste Is a Data Transfer

Riley Lin — Sun, 20 Sep 2026 11:39:30 +0000

You should treat every paste into a remote coding model as a copy you cannot delete later. The model might be free, the server might be complimentary, and the session might look ephemeral, but the bytes still left your machine. A crash dump, an env print, or a failing request log is not a private note once it crosses that hop. If you would not email the same text to a vendor, you should not drop it into a prompt.

The trust boundary sits at the moment text leaves your process and enters someone else's runtime. Your laptop, your container, and your test runner stay inside that line until you copy output into a chat. After that hop, you have created a second copy whose retention, access, and backups you do not control. A complimentary model endpoint is still a foreign disk with logs, even when the invoice is empty.

Think of the prompt box as a loading dock rather than a scratch pad beside your terminal. You can wheel a pallet of logs onto that dock in a single paste, and the truck leaves without a receipt. The analogy is imperfect, because a dock at least has cameras and a bill of lading you can later request. A model session often gives you neither, which is why the filter has to run on your side first.

Most painful leaks are not the function under review, but the debris that travels with a failing run. A Python traceback can echo a database URL, a request dump can echo an Authorization header, and a Docker inspect can echo a password. Those strings were never the question you wanted answered, yet they ride along because you pasted the whole pane. You can break that habit with a local gate that treats stdin as hostile until proven dull.

The proposed gate below is a filter, not a security product, and it will miss clever encodings. Run it on your machine, point it at the text you were about to paste, and only then involve a remote model. Keep the original log in a local file that never leaves the disk you already encrypt. Treat anything that survives the filter as still possibly sensitive, because regular expressions are a blunt instrument.

#!/usr/bin/env python3
"""redact_debug_paste.py

Proposed local gate for debug text you might paste into a remote model.
This is an unexecuted example: review it, then run it against synthetic fixtures.
It is not a DLP system and it will not catch every secret format.
"""
from __future__ import annotations

import argparse
import re
import sys
from pathlib import Path

RULES: list[tuple[re.Pattern[str], str]] = [
    (re.compile(r"(?im)^(authorization:\s*bearer\s+)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(api[_-]?key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(secret[_-]?key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(password\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(passwd\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(token\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]+\b"), "[JWT_REDACTED]"),
    (re.compile(r"\bAKIA[0-9A-Z]{16}\b"), "[AWS_KEY_ID_REDACTED]"),
    (re.compile(r"(?i)(aws_secret_access_key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)((?:postgres|mysql|mongodb|redis|amqp)://)[^\s]+"), r"\1[REDACTED]"),
    (
        re.compile(
            r"(?i)(-----BEGIN (?:RSA )?PRIVATE KEY-----)(.*?)(-----END (?:RSA )?PRIVATE KEY-----)",
            re.S,
        ),
        r"\1\n[REDACTED]\n\3",
    ),
    (re.compile(r"(?i)(x-api-key\s*[=:]\s*)\S+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(set-cookie:\s*)[^\n]+"), r"\1[REDACTED]"),
    (re.compile(r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.I), "[EMAIL_REDACTED]"),
]


def redact(text: str) -> str:
    for pattern, repl in RULES:
        text = pattern.sub(repl, text)
    return text


def main() -> int:
    parser = argparse.ArgumentParser(description="Redact common secrets from debug text.")
    parser.add_argument("path", nargs="?", help="File to read; defaults to stdin")
    parser.add_argument("-o", "--out", help="Write redacted text here instead of stdout")
    args = parser.parse_args()
    raw = Path(args.path).read_text(encoding="utf-8") if args.path else sys.stdin.read()
    cleaned = redact(raw)
    if args.out:
        Path(args.out).write_text(cleaned, encoding="utf-8")
    else:
        sys.stdout.write(cleaned)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

You can hang this script on the end of a failing command so the paste buffer never holds the raw pane. The commands below are the intended workflow, labeled as a proposal rather than a measured run. Swap the test path for the module that actually broke on your checkout before you pipe anything.

chmod +x redact_debug_paste.py

# Capture a failing test run, then keep only the redacted copy for later paste.
pytest app/tests/test_billing.py -vv --tb=short 2>&1 | tee /tmp/raw-fail.log | ./redact_debug_paste.py > /tmp/safe-fail.log

# Inspect what the gate changed before you touch any chat box.
diff -u /tmp/raw-fail.log /tmp/safe-fail.log | less

# Optional: copy the safe file, never the raw one.
pbcopy < /tmp/safe-fail.log          # macOS
# xclip -selection clipboard < /tmp/safe-fail.log   # Linux

A second command is worth keeping around for container noise, because compose files and inspect output are dense with connection strings. Pipe only the service that failed, and drop volumes and env blocks that the model does not need. The model can reason about a redacted URL scheme without ever seeing the password or the host.

docker compose logs payments --tail=200 2>&1 | ./redact_debug_paste.py > /tmp/safe-compose.log

# Proposed fixture: synthesize the error instead of exporting production.
cat > /tmp/synthetic-fail.txt <<'EOF'
Traceback (most recent call last):
  File "payments/charge.py", line 88, in charge
    client.capture(payment_id)
psycopg2.OperationalError: connection refused
DSN=postgres://[REDACTED]
Authorization: Bearer [REDACTED]
EOF

You should add a tiny self-check so the gate cannot silently rot after someone comments out a rule. The snippet below is a proposal you can drop next to the filter and run with pytest if you already use it. It does not prove absence of leaks, and it only proves the patterns you remembered still fire.

# test_redact_debug_paste.py — proposed checks, not a complete threat model.
from redact_debug_paste import redact

def test_bearer_and_dsn_die():
    dirty = (
        "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.aaa.bbb\n"
        "DATABASE_URL=postgres://alice:hunter2@db.internal:5432/billing\n"
        "user@example.com called charge()\n"
    )
    clean = redact(dirty)
    assert "hunter2" not in clean
    assert "Bearer eyJ" not in clean
    assert "alice" not in clean
    assert "[REDACTED]" in clean
    assert "[EMAIL_REDACTED]" in clean

Now the question is what still belongs in the prompt after the filter has done its pass. You want the shape of the failure, the names of the functions, and the assertion that died. You do not want customer identifiers, session cookies, private hostnames that map to production, or the contents of an env file. If the model needs a configuration sketch, write a fake one with obvious placeholders a contractor could see in a lobby.

That last habit matters when the assistant lives on a free endpoint you do not operate. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source coding assistant with free model access and a free server option. Use that endpoint on redacted fixtures and synthetic errors, not on a living incident that still contains tokens.

A useful check, written here as prose on purpose, is to ask three questions before the hop. Would this text be awkward in a public GitHub issue or in a vendor support ticket. Would this text still explain the bug if every credential became the word REDACTED. If the third answer is yes, you already have the prompt you needed without the extra debris.

There is a second class of leak that the script will not see, and you should not pretend otherwise. Editor plugins that upload a repository, and agents that read files you did not paste, both bypass stdin. A filter on a log file does nothing if the client ships a home directory or a dumped core as context. Disable automatic folder upload until you know the allow list, and keep secrets in a directory the agent cannot read.

The approach also fails when people treat a green self-check as a clearance stamp for the hop. Regular expressions miss tokens in base64 blobs, in truncated headers, and in screenshots this workflow never reads. Unicode tricks, split secrets across lines, and custom headers will sail through without a single match. If your world is PCI or HIPAA, this script is not your control, and you need a reviewed DLP path.

Who should skip this workflow is as important as who might try it on a Tuesday. Do not use a remote model as the first reader of a production crash when policy forbids off-box operational data. Do not use this filter as a reason to relax that policy after a noisy on-call night. Do not paste onto a complimentary server when the incident involves customer data, even if passwords look redacted.

If the bug only reproduces with a live secret, you have a design problem, not a prompting problem. Mock the credential, freeze a fixture, and make the failure mechanical on your own laptop before any paste. Then the text you send to any assistant is something you could publish without paging legal. That is the entire point of the gate: shrink the prompt until it looks like code review, not an incident export.

When you do try a remote assistant after the filter, send the smallest bundle that still fails. A twenty-line function and a redacted assertion will beat a four-hundred-line compose log every time. Keep the raw log in an encrypted local folder, and keep the chat side boring on purpose. If you try MonkeyCode, send a synthetic traceback through the gate first, then use the free server on that boring fixture.

Assume the Prompt Leaves Your Network

Riley Lin — Sat, 19 Sep 2026 09:43:55 +0000

When you paste a stack trace into a coding model, you have already crossed a trust boundary. The model is not a coworker on your VPN, and it does not inherit your log retention rules. Treat every prompt as outbound traffic you cannot recall, because caches, vendors, and reviewers may keep copies. The useful habit is not abstinence from assistants; it is a pre-flight check that strips secrets before the request leaves your machine.

You already treat production deploys this way, refusing to commit an AWS key or paste a customer dump into a public ticket. A coding assistant sits on the same side of the fence as that ticket: useful, remote, and outside the room where secrets belong. If vibe coding feels fast this week, the hidden cost is often a repo-sized paste that includes environment files and session cookies.

Draw the waterline before you type

Picture your laptop as a ship and the model as a harbor crane that unloads whatever you put on deck. Everything above the waterline can be shown to the crane; everything below it stays sealed in the hull. Source that is already public, failing tests, and redacted diffs usually sit above that painted line. Database URLs, refresh tokens, customer payloads, and staging cookies sit below it, even inside a log that looks harmless.

Once you name that waterline, the argument stops being moral and becomes operational for every paste. You either scan the payload, or you accept that the crane can see the hull without asking your security team. That choice is the whole method, and it belongs next to the editor rather than in a yearly training deck.

A practical waterline is boring on purpose, and that boredom is the feature you want in a hurry. If a string can mint access, identify a person, or map an internal network, it does not travel. If a string is a public API shape, a stack frame, or a failing assertion, it can travel after nearby comments lose ticket IDs. You are not trying to starve the model of context so much as keep a leaked prompt equal to a public issue.

What actually rides along in a small paste

Developers rarely paste a secret because they enjoy risk or because they forgot that credentials exist. They paste a file because the assistant asked for the full module, and that module imports settings that read the environment. The local shell still holds yesterday's cluster token, so the prompt looks like code review while the packet looks like an incident. You can watch the failure with a short Python example that nobody would call sensitive until you print what the process can see.

# demo_settings.py — labeled example, do not run against real credentials
import os

DATABASE_URL = os.environ.get("DATABASE_URL", "postgres://localhost/app")
STRIPE_KEY = os.environ.get("STRIPE_SECRET_KEY", "")
INTERNAL_HOST = os.environ.get("MESH_HOST", "payments.svc.cluster.local")

def debug_bundle():
    return {
        "db": DATABASE_URL,
        "billing": STRIPE_KEY[:7] + "..." if STRIPE_KEY else "unset",
        "mesh": INTERNAL_HOST,
    }

If you ask why checkout returns 500 and attach that debug bundle, you handed over a credential prefix and a mesh name. Truncating a key to seven characters is not redaction; it is a hint that still belongs in a secrets incident. The safer bundle is a schema and a fake value that preserves type without preserving access to anything real.

# labeled example: what you send instead of live values
SAFE_BUNDLE = {
    "db": "postgres://USER:REDACTED@127.0.0.1:5432/app",
    "billing": "sk_test_REDACTED",
    "mesh": "payments.internal.example",
    "error": "TimeoutError after 30s on POST /checkout",
}

Notice that the model still receives the shape of the failure without receiving the password or the real mesh DNS name. That is enough context for a patch and little enough context for a vendor log you will not see next quarter. You should prefer this trade every time the alternative is teaching a remote system how your staging network is wired.

A pre-flight gate you can run locally

You do not need a platform change to start this habit on an ordinary laptop this afternoon. You need a gate that refuses to copy a prompt until high-risk patterns have been removed from the buffer. The script below is a local filter, not a security product, and a match should be a hard stop. Run it on the file or snippet you are about to paste, then rewrite until the process exits cleanly.

#!/usr/bin/env python3
"""preflight_prompt.py — labeled local scanner, not a guarantee."""
import re
import sys
from pathlib import Path

PATTERNS = [
    ("aws_access_key", re.compile(r"AKIA[0-9A-Z]{16}")),
    ("generic_bearer", re.compile(r"(?i)bearer\s+[A-Za-z0-9._-]+")),
    ("pem_block", re.compile(r"-----BEGIN (?:RSA )?PRIVATE KEY-----")),
    ("jwt_like", re.compile(r"eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+")),
    ("connection_string", re.compile(r"(?i)(postgres|mysql|mongodb)://\S+")),
    ("env_assignment", re.compile(r"(?i)(api_key|secret|token|password)\s*=\s*\S+")),
    ("private_ipv4", re.compile(r"\b10(?:\.\d{1,3}){3}\b")),
    ("rfc1918_172", re.compile(r"\b172\.(1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2}\b")),
]

def scan(text: str) -> list[tuple[str, str]]:
    hits = []
    for name, rx in PATTERNS:
        for m in rx.finditer(text):
            snippet = m.group(0)
            clipped = snippet[:18] + "…" if len(snippet) > 18 else snippet
            hits.append((name, clipped))
    return hits

def main() -> int:
    if len(sys.argv) != 2:
        print("usage: preflight_prompt.py PATH", file=sys.stderr)
        return 2
    payload = Path(sys.argv[1]).read_text(encoding="utf-8", errors="replace")
    hits = scan(payload)
    if not hits:
        print("preflight: no high-risk patterns; still review by hand")
        return 0
    print("preflight: refuse to send until you rewrite these matches")
    for name, clipped in hits:
        print(f"  - {name}: {clipped}")
    return 1

if __name__ == "__main__":
    raise SystemExit(main())

Wire it to the copy step you already use so the chat window cannot outrun your patience.

python3 preflight_prompt.py /tmp/prompt.md && cat /tmp/prompt.md
# labeled example: only copy after a zero exit

If the scanner exits one, you do not paste, because a failed gate is cheaper than a rotation drill. You rewrite the snippet until the command exits zero, and then you still read the file, because regular expressions are not a legal team. Private IPv4 matches will false-positive on diagrams, and that pause is acceptable compared with a credential in someone else's log. A false positive wastes a minute; a false negative becomes an incident you explain with a screenshot of a chat box.

A small table beside the terminal

Use this compact table when you are unsure whether a snippet belongs above the waterline or below it.

Payload you want to send	Crosses the waterline?	What to send instead
Failing unit test and assertion	Usually no	The test, the expected value, the truncated stack
`.env` or `secrets.yaml`	Always yes	Names of keys only, with fake values
Production access logs	Yes, if they identify users	One synthetic line plus status codes
A JWT from a local login	Always yes	Header `alg` and a note that `sub` exists
Internal RFC1918 addresses	Yes	`10.x` rewritten to `net-a.example`
Open-source library error	Usually no	Version pin and the error string

Keep the table short so you will actually use it when a model is waiting and a deadline is closer than a policy review. The point is not completeness; the point is a default of redact-then-ask, which inverts the habit of dumping a repository and hoping. When a row is ambiguous, you shrink the paste rather than enlarge the model's memory of your private network.

Logs are a second copy of the same mistake

The prompt is not the only place a secret lives after you hit send in a browser tab. Extensions, local agent traces, CI jobs that echo the assistant, and share-thread buttons all create extra copies you will forget. If your team reviews assistant transcripts the way you review pull requests, those transcripts become a corpus with weaker access control than git. You should assume a coworker will search that corpus for the checkout fix and will find whatever you pasted.

A small discipline helps here, because the second copy is how last quarter's debug session becomes this quarter's audit question. Name the local transcript file, keep it out of git, and run the same preflight on it before you attach it to a ticket.

echo "transcripts/" >> .gitignore
python3 preflight_prompt.py transcripts/checkout-timeout.md

That extra command is dull, which is the point, because dull gates survive Friday deploys better than slogans do.

If you use a remote coding assistant, ask where prompts are stored, who can read them, and whether human review is on by default. You do not need a brochure to start that conversation with the same questions you already ask a log aggregator. Retention, region, and whether delete means delete are more useful than a feature list when the payload might include a token.

MonkeyCode can sit in that remote slot when you want a coding model without standing up your own inference box. Disclosure: This article was prepared as part of MonkeyCode's product outreach, covering only free model access and a free server option. That is enough to practice this redaction workflow on throwaway snippets, and it is not a reason to skip the scanner. A free endpoint still lives outside your hull, so try it with the redacted test and the fake bundle rather than the vault.

Limitations, and who should skip this

This scanner will miss secrets that do not look like secrets to a regular expression on a laptop. A customer surname in a comment, a signed cookie that is not a JWT, and a headerless base64 blob will walk through. It will also nag you about private addresses in architecture diagrams you actually intended to share with a teammate. Regex is a seatbelt rather than an airbag, and it does not replace a secrets manager or a company DLP tool.

Do not use this approach as a compliance program for regulated health data, cardholder data, or government systems that already have a vendor list. Those workloads need a written policy, a reviewed processor, and a default of local models or no remote models at all. Do not send them through a public or free remote endpoint, including a free MonkeyCode server, because price does not move the boundary. Hobby projects, public open-source debugging, and synthetic fixtures are the right blast radius for this particular habit.

The conclusion stays the one you started with, because the boundary did not get softer while you were reading. You can let an assistant write the patch, but you cannot let it inherit your network or your customer table. Draw the waterline, run the gate, and paste the diff rather than the vault that made the test fail. That habit is slower than a full-repo dump by about thirty seconds, and faster than rotating every token you mailed to a crane.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The Agent Is a Subprocessor

Riley Lin — Fri, 18 Sep 2026 08:05:10 +0000

You should treat every coding-agent prompt as a network egress event, not as a private scratchpad. Secrets, customer dumps, and internal hostnames leave your control the moment they enter a context window. A cheap redaction pass before the call is more reliable than hoping a vendor will forget. The rest of this article turns that rule into a repeatable threat model and a small sanitizer you can run locally.

Coding assistants now sit inside the same loop where you reproduce bugs and paste stack traces. That convenience quietly collapses the old habit of keeping production clues on an isolated jump box. The model feels like a colleague on your laptop, which is why people paste .env files without flinching. Your threat model has to assume the opposite: the model is a processor you do not operate.

Picture four rooms with locked doors between them, even if the UI draws them as one chat. Room one is your workstation, including the repo, the shell history, and local secret stores. Room two is the agent runtime, which can read files, run commands, and assemble a context bundle. Room three is the model endpoint, and room four is whatever logs or eval traces that endpoint still retains.

Anything that walks from room one into room three has crossed a trust boundary you cannot reverse. Remote assistants make that crossing obvious, because the weights and the disks are visibly not yours. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option, which helps you rehearse the same workflow without pretending the bytes stayed local.

You do not send live credentials, session cookies, or private keys, even when the bug only reproduces with them. You do not send customer records, health data, or payroll extracts just to get a prettier SQL rewrite. You do not send internal architecture diagrams that name unreleased hostnames, jump boxes, or VPN paths. You also do not send other people's unreleased source, because a context window is not a license grant.

The quieter leak is not the prompt you remember; it is the transcript you forget. Agent products write session logs, tool traces, and sometimes prompt caches onto disk you do not inspect. If your company later issues a legal hold, that chat history can become a document you never meant to keep. Rotate the habit: assume every turn is written down, then decide whether that sentence should exist.

You cannot prompt your way out of a data-flow problem, because instructions are not a boundary. Telling the model to forget a key still placed the key in the request body. Vendors may train, debug, or cache that body under terms you have not read this week. The only reliable denial is omission, which means you never put that byte in the packet.

There is a time-of-check failure that many agent workflows quietly ignore when a deadline is close. You redact a copy, then the agent uses a file tool and reads the live path anyway. The trust boundary failed because the runtime still had permission to enter room one. Pin the agent to the redacted path, or disable file tools until the brief is clean.

The practical control is boring on purpose, which is why it still works under deadline pressure. You stage a context file, you run a local redactor, and only then do you let the agent read the file. The script below is an example you should adapt, not a compliance product and not a guarantee. It writes a receipt of every hit so you can see what almost left the building.

#!/usr/bin/env python3
"""Example context redactor. Adapt before use. Not a DLP product."""
from __future__ import annotations

import re
import sys
from pathlib import Path

PATTERNS = [
    ("aws_akid", re.compile(r"AKIA[0-9A-Z]{16}")),
    ("jwt", re.compile(r"eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}")),
    (
        "pem",
        re.compile(
            r"-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----"
        ),
    ),
    ("bearer", re.compile(r"(?i)(authorization:\s*bearer\s+)\S+")),
    (
        "url_cred",
        re.compile(
            r"(?i)((?:https|postgres|mysql|mongodb|redis)://)[^/\s:]+:[^@\s]+@"
        ),
    ),
    (
        "rfc1918",
        re.compile(
            r"\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|"
            r"192\.168\.\d{1,3}\.\d{1,3}|"
            r"172\.(?:1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3})\b"
        ),
    ),
    ("email", re.compile(r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.I)),
    (
        "env_secret",
        re.compile(
            r"(?im)^([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PWD))\s*=\s*.+$"
        ),
    ),
]


def redact(text: str) -> tuple[str, list[str]]:
    receipt: list[str] = []
    out = text
    for name, rx in PATTERNS:
        def repl(match: re.Match[str], label: str = name) -> str:
            receipt.append(f"{label}:{match.start()}")
            if match.lastindex:
                return match.group(1) + f"<REDACTED:{label}>"
            return f"<REDACTED:{label}>"

        out = rx.sub(repl, out)
    return out, receipt


def main() -> None:
    if len(sys.argv) != 2:
        print("usage: redact_context.py <file>", file=sys.stderr)
        sys.exit(2)
    src = Path(sys.argv[1])
    text = src.read_text(encoding="utf-8", errors="replace")
    cleaned, receipt = redact(text)
    out = Path(str(src) + ".redacted")
    rec = Path(str(src) + ".receipt")
    out.write_text(cleaned, encoding="utf-8")
    rec.write_text(("\n".join(receipt) + "\n") if receipt else "", encoding="utf-8")
    print(f"wrote {out} with {len(receipt)} hits; receipt {rec}")


if __name__ == "__main__":
    main()

Label the next block as an unexecuted example test, then run it only against synthetic fixtures you created. The point is not coverage theater; it is proving the redactor actually deletes the shapes you think it deletes. If this test fails on your laptop, you are not ready to brief an agent with a staging dump.

# Example test. Do not paste production tokens into this file.
def test_redact_jwt_and_env() -> None:
    sample = (
        "Authorization: Bearer eyJhbGciOiJub25lIn0.e30.fakesig\n"
        "STRIPE_SECRET_KEY=sk_live_example_not_real\n"
        "postgres://app:hunter2@10.0.4.12:5432/orders\n"
    )
    cleaned, receipt = redact(sample)
    assert "fakesig" not in cleaned
    assert "hunter2" not in cleaned
    assert "sk_live_example_not_real" not in cleaned
    assert "10.0.4.12" not in cleaned
    assert any(item.startswith("bearer:") for item in receipt)
    assert any(item.startswith("env_secret:") for item in receipt)

Run the example against a staging dump before any agent call, and keep the receipt beside the ticket. If the receipt is empty, you probably pointed the redactor at the wrong input file. If the receipt is huge, you are briefing the model with material that should have stayed in room one. Either outcome remains useful, because both results beat pasting a raw production log into chat.

A second local gate belongs at the repository edge, so tracked secrets never become default context. These ordinary commands stay on your machine and they do not phone home by themselves. They will not replace a vault, but they catch the cases that make incident reviews painful.

# Example local gate. Pin the agent to the redacted path only.
set -euo pipefail
src="${1:?usage: gate_context.sh <file>}"
python3 redact_context.py "$src"
redacted="${src}.redacted"
receipt="${src}.receipt"

if [ ! -s "$receipt" ]; then
  echo "receipt empty; confirm the redactor scanned the file you intended" >&2
fi

git grep -nE 'AKIA[0-9A-Z]{16}|BEGIN .*PRIVATE KEY|eyJ[A-Za-z0-9_-]+\.' -- \
  ':*.env' ':*.yml' ':*.yaml' ':*.log' ':*.md' || true

# Refuse to hand the live path to an agent file tool.
echo "agent may read: $redacted"
echo "agent must not read: $src"

When a bug needs a token to reproduce, mint a disposable fixture instead of laundering the real one. Replace customer names with stable aliases, then replace account IDs with obviously fake numeric ranges. Keep a small translator on your side of the boundary so you can map the model's advice back. That translator is part of the threat model, because it stops you from pasting the real roster just this once.

# Example policy function. Proposal only, not legal advice and not a control.
def may_send(kind: str, has_prod_ids: bool, has_secrets: bool) -> str:
    if has_secrets:
        return "block: strip credentials or recreate the case with fixtures"
    if kind in {"customer_dump", "hr_export", "medical"}:
        return "block: keep the bytes in room one"
    if kind == "stack_trace" and has_prod_ids:
        return "rewrite: replace hostnames, tokens, and correlation ids"
    if kind in {"unit_test", "public_repro"}:
        return "allow: still run the redactor on the bundle"
    return "review: default deny until a human looks"

Think of that function as a customs officer who cannot be sweet-talked by a clever system prompt. Stack traces can travel after you rewrite identifiers, because the control flow is often the actual question. Customer tables cannot travel, because the model does not need a real person to rearrange a query. Secrets cannot travel even in comments, because comments still sit inside the same request body.

Regex scanners will miss novel secret formats, unicode lookalikes, and screenshots that never become text. A local model still writes swap files, core dumps, and IDE chat databases you might later back up to the cloud. This workflow is a seatbelt, not an airbag, and it will not satisfy a PCI or HIPAA auditor by itself. If you need a real control, you want DLP, a vendor review, and a written data processing agreement.

Do not use this approach as cover for sending production data to a hobby endpoint. Do not use it if your employer already forbids unaudited model providers, because a redactor does not create permission. Do not use it as a substitute for fixtures when the right move is to synthesize a failing test. Teams that already handle export-controlled or classified source should stay on their approved air-gapped path.

If you want a remote place to practice the redacted workflow, MonkeyCode's free model access and free server option are one such room three. Keep the sanitizer in room one, send only the .redacted file, and store the receipt with the ticket. The agent can still help you refactor the code once those secrets have left the brief. That is the whole method: you draw the boundary, then you talk across it on purpose.