GL-S-017Sheet 017FOR INFORMATIONS · SECURITY
The most common way a secret leaks is a paste.
HOLD POINT · THE PASTE · CHAT PROMPTS · FIELD REPORT
General notes
- 01Nobody uploads a production key on purpose. They paste an error log into a chat to ask why it failed. The key is in the log.
- 02Vendor keys have prefixes a scanner can catch. The hard case is plain: "my api key is …" typed in a sentence, too short to look random.
- 03Anchor on the label, validate the value, and leave "password is required" alone. That is prose, not a secret.
Schedule of secret shapesHow each is caught
| Shape | Example | Caught by |
|---|---|---|
| Vendor prefix | sk-… · AKIA… · ghp_… | Prefix and length |
| Labelled value | "my api key is …" · "my password is …" | Label anchor + value validator |
| Prose | "api key management" · "password is required" | Left alone (denylist) |
As posted
The most common way a secret leaks is a paste.
It's 11pm. You paste the log into a chat and ask why. The key is in the log.
Vendor prefixes are easy. "my api key is …" in a sentence, too short to look random, is not.
Anchor on the label. Validate the value. Sheet 017.