Guides

Remove API keys and secrets before you share code or logs

Pasting a config file into an AI chat to debug it is quick. It is also how keys end up in chat histories, GitHub issues and forum posts. Secrets are easy to miss when you read code, because they look like any other string.

What counts as a secret

• Keys with known prefixes: sk- (OpenAI), sk-ant- (Anthropic), sk_live_ (Stripe), ghp_ (GitHub), AKIA (AWS access key IDs), xoxb- (Slack), AIza (Google) and others.
• Values in key and password fields: api_key=, "password": "…", and JSON Web Tokens (eyJ…).
• Passwords inside URLs: postgres://user:password@db.internal:5432/app.
• Private key blocks: -----BEGIN PRIVATE KEY----- and the lines after it.
• Long random-looking strings that match no known format but have the entropy of a token.

The Anonymizer detects all of these, along with the internal host names, IP addresses and emails that usually sit next to them.

Step by step

1. Open the anonymizer with the Log file preset: it skips name detection, which mostly misfires on code, and replaces values with stable hashes, so the same key gets the same code on every line.
2. Paste the code, config or log, or open the file.
3. Check the findings. Add your own internal domains and service names to the custom terms list.
4. Copy the result into the AI chat or the issue.

If a key was already shared

Rotate it. Replacing it in the text afterwards doesn't take it back out of a chat history, a provider's logs or an issue's edit history. Then look at what prevents the next leak: environment variables or a secrets manager instead of keys in config files, and a secret scanner such as gitleaks in your repository's pipeline.