Why you shouldn't paste raw .env keys into ChatGPT (and how to sanitize them locally)

Description and use

Developers often accidentally paste secrets into LLM prompts, exposing them. CleanPrompt is a client‑side tool that scrubs secrets in the browser without sending data to servers.

Problem

Developers often accidentally paste sensitive environment variables into LLM prompt windows, exposing secrets to third‑party servers.

Outcome

Secrets are removed locally without any network traffic, preventing accidental leakage to LLM providers.

Workflow

• 1. Open CleanPrompt in the browser. 2. Paste code or text containing secrets into the left pane. 3. The tool detects secrets using regex and masks them. 4. Choose a replacement style (redacted tag, asterisks, or mock env variable). 5. Copy the sanitized output from the right pane. 6. Paste the sanitized text into the LLM prompt.
• 7. The LLM processes the prompt without receiving any raw secrets.

Evidence

I built CleanPrompt — a lightweight, zero‑leak prompt and code sanitizer.

Source

100% Client‑Side RAM: Detection and token masking run purely via in‑memory Regex inside your browser session.

Source