Journal · The AI Architect · 2026-08-25
A secret is a house key — never tape it to the door. Credentials belong in secure settings, never in a message.
A secret is a house key — never tape it to the door. Credentials belong in secure settings, never in a message.
The tension isn’t really about secrecy. It’s about convenience. Every developer knows credentials shouldn’t live in plaintext — and yet API keys end up in Slack messages, tokens get pasted into chat prompts, passwords sit in code comments “just for now.” The gap between knowing and doing is where the trouble lives, and it’s worth asking why that gap exists before pretending a rule alone will close it.
The problem is speed, not ignorance
Nobody pastes a credential into a message because they don’t understand risk. They do it because they’re moving fast and the secure path feels like friction. You need to test something right now, and the vault, the secrets manager, the approval step — all of it feels like a detour. So you take the shortcut, tell yourself you’ll clean it up later, and later rarely comes.
This matters because it means the fix isn’t more warnings. People already know. The fix is making the secure path at least as fast as the insecure one. If pulling a credential from a proper secrets store takes ten extra seconds, most people will do it. If it takes ten extra minutes, most people won’t, no matter how many times they’ve read a line like “never tape the key to the door.”
Try this: the next time you’re about to share a credential — with a teammate, a script, an AI assistant, anywhere — pause and ask where it’s going to live for the next hour. Not where you intend to move it eventually. Where it actually sits right now. If the honest answer is “in a chat log” or “in a prompt window,” that’s your signal to stop and use a secrets manager or environment variable instead, even if it costs you a few minutes.
Treat AI tools like a very literal-minded coworker
This is the part that catches people off guard. We’ve built decades of instinct around not emailing passwords or posting them in tickets. But AI assistants are new enough that the instinct hasn’t caught up. People will happily paste a database connection string into a chat window to “help the AI understand the problem,” without registering that they’ve just done the exact thing they’d never do in an email.
The AI doesn’t need the actual key to help you debug a connection issue. It needs to know the shape of the problem — what’s failing, what the error says, how the pieces are supposed to fit together. The credential itself is almost never necessary information. It just feels necessary because it’s sitting right there in your terminal when you copy the error.
Try this: before pasting anything into an AI tool, do a quick find for patterns that look like secrets — long random strings, anything starting with a known key prefix, anything you’d wince at if a screenshot leaked. Redact or replace it with a placeholder like <API_KEY> before you hit send. It takes a moment and it becomes automatic surprisingly fast.
Rotation is your safety net, not your backup plan
Even careful people leak credentials sometimes. A repo goes public by accident. A log file gets shared. A message doesn’t get deleted before someone screenshots it. Assuming this will never happen to you is the actual risk, more than any single mistake.
The practical answer is to make credentials cheap to rotate and short-lived by default. A key that expires in a day does far less damage if it leaks than one that’s been valid for two years. This isn’t about distrust — it’s about designing systems where a single slip doesn’t turn into a disaster. If your tools support short-lived tokens or scoped permissions, use them, even when it feels like overkill for something “low stakes.” Low stakes is exactly when people get sloppy.
Try this: pick one credential you use often — a personal access token, an API key for a side project — and set a calendar reminder to rotate it this month. Not because it’s compromised, but to build the muscle of treating rotation as routine maintenance rather than emergency response.
None of this requires new tools or deep expertise. It requires noticing the moment before you paste, share, or store something, and choosing the slightly slower path on purpose. That habit, more than any policy, is what actually keeps a key from ending up taped to the door. The book goes further into how to build these habits into a team’s workflow so they don’t depend on any one person remembering to be careful — but the essay above is where the real work starts.
Go deeper. The full method is in The AI Architect. New here? Start with the free companion pack, or explore the series.