Secrets, PII, and Data Handling
Keep API keys out of prompts and logs, handle personal data responsibly, and understand what data leaves your machine.
Agents are very good at reading things. That's the problem. A coding agent asked to "figure out why the app won't start" will happily open your .env file, print your database password into the transcript, and paste it into a debug log. A support agent given a customer's full record will carry their address, phone number, and order history through every model call, every trace, and every log line your system writes.
None of that requires an attacker. It's just what happens when software that reads everything meets data that should be read by almost nobody. This lesson shows you where secrets and personal data leak in agent systems, how to keep API keys out of prompts and logs, how to handle personal data responsibly, and how to figure out what actually leaves your machine when you use an agent.
Where secrets leak in agent systems
A secret is any value that grants access: API keys, database passwords, OAuth tokens, signing keys, session cookies. In an agent system, secrets escape through more doors than in traditional software:
- The context window. Anything the agent reads (a config file, an environment dump, a tool result) becomes part of the conversation sent to the model provider.
- Prompts. Developers sometimes paste keys into system prompts "so the agent can call the API." The key then rides along on every request.
- Transcripts and session history. Coding agents and chat apps store conversation history, sometimes locally, sometimes in the cloud.
- Logs and traces. Observability tools capture full prompts and tool inputs by default. Your tracing dashboard may be the most secret-filled place in your company.
- Model output. An agent that has seen a secret can repeat it: in a commit message, a code comment, a reply to a user, or a pull request description.
- Git history. The agent writes a key into a file "temporarily," commits, and now it's in history forever, even after you delete the line.
The guiding rule is simple: the model never needs to see a raw secret. The model decides what to do. Your code, holding the secret, does it.