Lesson 13 — Don't paste secrets: redact before you send

What goes into the chat leaves your computer

Whatever you paste into a chat assistant is sent to the company that runs it. Logs, config files and error messages often contain secrets: API keys, passwords, customer emails. The rule is simple: never paste secrets. Remove them first.

A regular expression (regex) describes a text pattern. re.sub(pattern, replacement, text) replaces every match:

import re
re.sub(r"\d+", "#", "room 42, floor 3")   # 'room #, floor #'

Useful pieces: \w = letter, digit or _; + = one or more; [...] = any of these characters; \. = a real dot.

Many services give their keys a recognizable prefix. In this lesson our fake keys start with demo_key_ — real ones look different for every service.

Watch out: redaction is a safety net, not a permission. If a real key ever ends up in a chat, a repo or a screenshot, revoke it and make a new one — deleting the message is not enough. Keep keys out of code entirely (for example in environment variables).

Why it matters: a leaked key can be used by anyone who sees it, and the bill or the data breach is yours.