Secrets that never hit a git commit still reach your AI tools

A clean git history does not mean a key stayed private. Most teams scan commits for secrets, and that is a good habit. But a key can reach an AI tool without ever touching a commit.

Three quieter paths

The first is the config file. Many AI tools and MCP servers read settings from a local file, and the easy way to set them up is to paste an API key straight in. The file sits in a home directory, outside the repository, so no commit scanner sees it. Backups, sync folders and shared screenshots can still pick it up.

The second is the terminal. A key exported in a shell session, or typed inline in a command, lands in shell history. A coding assistant that can read the terminal or run commands can read it too.

The third is the pasted log. Someone hits an error and pastes the output into a chat to get help. Request headers, connection strings and debug dumps often contain a token. Once pasted, it has left your control.

A hypothetical example

This is a demo scenario, not client work. Say a team builds a read-only lookup that lets an assistant answer questions about open support tickets. The service account key lives in the assistant's config file. A developer debugging a failed call pastes the verbose output into a chat window. The key is in the third line.

Nothing was committed. The key was still exposed.

Checks for one workflow

Pick one workflow and look at it end to end. We review these things:

• Where does the key live, and who or what can read that location?
• Is the key scoped to read-only access for this one task?
• Does the tool pull the key from an environment or secret store at run time, rather than from a plain text file?
• Can verbose logs be redacted before anyone pastes them?
• Can the key be rotated in minutes, and does anyone know how?

A handoff someone can use

The output should be short and plain: a list of where the key travels, what was changed, and one rotation step written down for whoever owns the workflow. If the answer to the last check is "no," that is the first fix. A scoped, short-lived key turns a leak from a crisis into a chore.

Privacy still applies

Internal, non-regulated work still carries privacy and security duties. Support tickets contain customer names and emails. A leaked key to that system is a real problem even if no regulator is involved.

You do not need a company-wide program to start. Choose one lookup or one draft-for-review workflow, trace the key, and fix the weakest point. Then repeat when the next workflow comes along.

I'm Jonathan Melton. I run FusionAL, focused on reviewing and integrating lower-risk internal AI workflows, one bounded workflow at a time.