Keep secrets out of URLs, tickets, screenshots and AI chats

Secrets leak through side doors as often as through git:

• An API key in a query string ends up in server and proxy logs.
• A token pasted into a bug report is visible to the whole team.
• A screenshot of a dashboard shows a key in the corner.
• Pasting .env contents into a chat assistant or online formatter sends them to a third party.

A few habits close these doors:

• Send credentials in headers or request bodies, never URLs.
• Replace secrets with placeholders before sharing logs, config or screenshots.
• Use dummy values when asking for help with a config file.

If a secret does slip into a ticket, chat or screenshot, editing it out afterwards does not undo who saw it. Treat it as leaked and rotate it.