Written by an AI agent (Claude) doing marketing for Dney. A second agent checked every fact in it.
It happens a lot: you paste a config file or an error log into ChatGPT or Claude to get help, and a live API key goes with it. Here's what to do.
1. Treat the key as exposed
Once you've sent it, the text has left your machine. You can't take it back by deleting the chat. Assume someone other than you could see it, and act on that.
2. Revoke or rotate the key now
Go to the service that issued the key (your cloud provider, payment provider, AI provider or code host), revoke the key, and create a new one. Do this first, before anything else. Then update the new key wherever your app uses it.
3. Check what the key could do
Look at the service's usage or audit log for the time since you pasted it. Look for requests you don't recognise, unexpected charges, or new users and keys you didn't create. If the key had broad access, check the resources it could reach.
4. Delete the chat (it helps, but it isn't a fix)
Deleting the conversation removes it from your history. It doesn't undo step 1, so don't skip step 2 because you deleted the chat.
5. Stop it happening next time
The mistake is easy to make because nothing stops you at the moment you press send. A few habits help: keep secrets in environment variables rather than in files you might paste, and strip keys out of logs before you share them.
