The latest articles on DEV Community by ThomasShyju (@thomasshyju). https://dev.to/thomasshyju https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4101692%2F545f3a8c-1e98-4838-b5d9-b29fbf8657ff.png https://dev.to/thomasshyju en ThomasShyju Sun, 30 Aug 2026 17:51:56 +0000 https://dev.to/thomasshyju/why-you-shouldnt-paste-raw-env-keys-into-chatgpt-and-how-to-sanitize-them-locally-3735 https://dev.to/thomasshyju/why-you-shouldnt-paste-raw-env-keys-into-chatgpt-and-how-to-sanitize-them-locally-3735 <p>canonical_url: <a href="https://cleanprompt-privacy.vercel.app/" rel="noopener noreferrer">https://cleanprompt-privacy.vercel.app/</a></p> <p>Like most developers, I use LLMs (ChatGPT, Claude, DeepSeek) all day to debug scripts, refactor architecture, and troubleshoot logs.</p> <p>The problem? It is astonishingly easy to accidentally highlight and paste sensitive secrets into prompt windows:</p> <ul> <li>OpenAI / Anthropic / AWS access keys</li> <li>GitHub Personal Access Tokens (PATs)</li> <li>Production database connection URIs (<code>postgres://...</code>, <code>mongodb+srv://...</code>)</li> <li>Bearer tokens &amp; JWTs</li> <li>Internal company URLs, local IP ranges, and private emails</li> </ul> <p>Once you hit enter, those credentials leave your local machine and land on external third-party servers.</p> <h2> The Solution: Local In-Browser Scrubbing </h2> <p>I built <strong><a href="https://cleanprompt-privacy.vercel.app/" rel="noopener noreferrer">CleanPrompt</a></strong> — a lightweight, zero-leak prompt and code sanitizer.</p> <p>👉 <strong>Live Utility:</strong> <a href="https://cleanprompt-privacy.vercel.app/" rel="noopener noreferrer">https://cleanprompt-privacy.vercel.app/</a></p> <h2> How It Works Under the Hood </h2> <ul> <li> <strong>100% Client-Side RAM:</strong> Detection and token masking run purely via in-memory Regex inside your browser session.</li> <li> <strong>Zero Network Requests:</strong> No backend, no databases, no fetch calls, no telemetry tracking.</li> <li> <strong>Instant Replacement Options:</strong> Replace discovered secrets with clean descriptive tags (<code>[REDACTED_API_KEY]</code>), standard masking (<code>***</code>), or mock environment variables (<code>{{AWS_KEY_ENV}}</code>).</li> <li> <strong>One-Click Workflow:</strong> Paste code on the left, copy sanitized output on the right, and paste safely to AI.</li> </ul> webdev security ai opensource