The Paste That Leaks: Build a Gate Between Your Repo and the AI Context

说明与用途

将包含凭证的日志粘贴到 AI 模型中可能导致泄露。门脚本在将内容输入 AI 会话前扫描文件，检测并阻止包含秘密的内容。

问题

Engineers paste stack traces into AI models, unintentionally leaking secrets such as passwords and connection strings into the model’s session history, which can be exported or retained by the platform.

结果

The gate script successfully identified the Redis URL with credentials in the dangerous log file and prevented it from being pasted into the AI session, mitigating the risk of secret leakage.

工作流

• 1. Create a test repository with a clean log file and a dangerous log file containing a Redis URL with credentials.
• 2. Run the secrets_gate.py script against the files or stdin to detect secret patterns.
• 3. If the script exits with findings, block the paste and alert the engineer.
• 4. Only allow pastes that pass the gate to enter the AI session.

证据

The failure we keep seeing lives at boundary two. The reason is always the same: the paste was urgent, not malicious.

来源

Here is the gate I run on any file before it is allowed to enter a session context. It is deliberately small: just five regex patterns and an exit code.

来源