The key you pasted into chat
To get working, you pasted your into your app builder's chat. The project was public. Your builder has just announced a data exposure.
This answers: Is it safe to paste API keys into an AI chat? No coding needed. 2 quick decisions.
- Keys and secrets
- Supervising your AI
Checking your access…
Is it safe to paste API keys into an AI chat?
No. Chats and prompts are stored, sometimes shared with the project, and can be exposed if the project or platform leaks. Put secrets only into your app's secret or environment settings. If you already pasted one, rotate it with the provider and make the project private.
Breaks at AI agent: Secret stored in a public chat
How it works
Your server: private
Every visitor's browser: public
Why AI tools write this bug
When setup gets stuck, pasting a key into the chat is the fastest way to get an AI builder to 'just make it work'.
How to fix it
- Rotate any key you pasted into a chat.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Does deleting the chat message remove the key?
- Not necessarily. Copies may already exist. Rotating the key is the only reliable fix.