Using AI Without Leaking Your Secrets: A Threat Model for AI-Assisted Development

Short summary

Pasting secrets into LLM prompts is like pasting them to Pastebin—except you can't retrieve them. The guide covers three data-leak paths (explicit paste, auto-attached context, model echo-back) and a pragmatic framework: use paid tiers with no-training agreements for most work, and reserve self-hosted models only for regulated data. Build discipline with ignore files, secret scanning, and credential masking.

• •Three data-leak vectors: explicit pastes, auto-attached context, and model echo-back of secrets
• •Paid tiers with no-training agreements are safer for proprietary work; local models only for regulated data
• •Implement concrete habits: AI ignore files, pre-send secret scanning, and credential masking with placeholders

Generated with AI, which can make mistakes.