What not to paste
- privacy
- verification
Three categories never belong in a chat box: secrets (keys, passwords, tokens), other people’s personal data, and your organization’s confidential material. Almost everything else can go in — after a quick scrub. The skill is classification, and it takes ten seconds.
The three buckets
- Secrets. API keys, passwords, tokens, connection strings. A pasted key is a leaked key: remove it, rotate it, and describe the problem without it. The same rule as hardcoded keys in code — here the leak is the paste itself.
- Personal data. Names, emails, purchase histories, health or personnel records of real people. The task almost never needs the identities — replace them:
Client A,a@example.com. The structure teaches the AI everything; the identities only add risk. - Confidential material. Unreleased pricing, contracts, financials, strategy. Check your organization’s rules first; when there is no rule, generalize — describe the shape (“a SaaS contract with a 60-day termination clause”) instead of pasting the document.
The scrub habit
Two moves — replace and generalize, which is all redaction means — make most content safe:
- Replace specific values with placeholders —
[amount],[customer name]— the same convention that keeps drafts honest. - Generalize the details that do not affect the task. “A client in the EU” carries the same meaning for drafting purposes as the actual client’s name.
Paste the scrubbed version; keep the original where it lives. If the answer seems off because you scrubbed too much, re-add detail category by category — never identity.
What “pasted” really means
Treat anything you paste as leaving your building: depending on the tool and its settings, it may be stored, reviewed or used to improve systems. That does not make AI unusable — it makes the ten-second classification the first step of every task. Provider specifics vary and change; they get their own dated, sourced lesson in a later wave.
A bad example
Paste: “Our API key sk_live_… stopped working, and here’s the full customer export to debug with.”
One message, two rotatable disasters — a credential and thousands of people’s data, now outside your control.
A better example
Paste: “An API key that looks like
sk_live_[REDACTED]suddenly returns ‘invalid key’ this morning. Nothing changed on our side. What are the likely causes?”Same debugging help, no secrets, nothing to rotate.
Practice
Spot what should not be pasted
A colleague drafted one request for an AI chat tool. You get a single review pass before it is pasted — check what travels and what must not.
Flag every part that should not be pasted as-is.
The AI answer
Help me with several things. Our billing API key sk_live_4d91 stopped working this morning, and this error keeps appearing: 'ECONNREFUSED'. Also, summarize the attached customer_export.csv (12,000 rows with names, emails and purchase history) into our top segments. For tone, check the screenshot of our unreleased Q4 pricing page. Finally, fix this paragraph about the office party — here it is.
Hint
Sort each item into a bucket: secret, personal data, confidential, or fine?
Which items would still work for the AI after a scrub — and which must simply leave the request?
Why this is the answer
Three buckets, three flags: a credential, other people's personal data, and unreleased business numbers. The error message and the party paragraph carry none of that — they can stay as they are. The fix for the middle is not 'never use AI' but scrub: placeholders for identities and values, generalize the rest.
Transfer
- Debugging sessions: error messages yes, keys never.
- Meeting notes: summarize internal-but-not-secret content freely; scrub figures you are not allowed to share.
- Photos and screenshots: check what is visible before they travel — a dashboard screenshot is a data dump.
Next
Next: Prompt injection, simply — the other direction of the same boundary: what happens when untrusted content comes in and carries instructions with it.