Keep secrets out of the work path

A practical boundary for keeping API keys and personal data away from AI-assisted development.

Never paste an API key into a prompt when a server-side operation can handle it.

Keep .env and secrets directories outside the agent's normal reading path.

Check logs, screenshots, and commits before publishing or sharing the project.

Run the five-question safety check before you delegate.