{"slug": "keeping-secrets-out-of-an-ai-chat-log-what-i-do-and-where-it-falls-short", "title": "Keeping secrets out of an AI chat log: what I do and where it falls short", "summary": "A developer building Styx, an open-source app that runs coding agents side by side, described a two-layer approach to keeping secrets out of agent chat logs: pattern-based scrubbing of stored message text and attachments, plus a masked input path that keeps credentials out of the transcript entirely, with real secrets held in the OS keychain and referenced by id. The developer cautioned that shape-matching alone lets short passwords and tokenized internal URLs through, and that scrubbing a log does not prevent data from reaching the agent's provider.", "body_md": "A coding agent's chat is a log, and a log is where secrets end up: a token pasted to \"just try it\", a connection string in a stack trace, a key in an attached file. In my app, anything I store goes through a scrubber first.\n\nThe first layer is scrubbing by shape. Message text is stored with anything that looks like a secret removed, and what an agent supplies that gets saved goes through the same redaction. Attachments that look like keys or credentials are refused outright.\n\nThe lesson is that shape-matching is a net, not a wall. A secret that doesn't look like one, like a short password or an internal URL with a token in it, gets through.\n\nSo the second layer is a path that never touches the log. When an agent needs a secret from the person, its question gets a masked field, and the answer is kept out of the transcript. The real credentials sit in the OS keychain and everything else refers to them by an id.\n\nThe tip, then: scrub what you can by pattern, but don't make the pattern your only defence. Give people a place to put a secret that you've designed never to be logged, and make it the easy one.\n\nWhere it doesn't help: a secret typed into a normal message is still only protected by the pattern. And scrubbing the log doesn't un-send anything to the agent's own provider, so treat what you type into any agent as shared with it.\n\nThis is from building Styx, an open-source app that runs coding agents side by side.", "url": "https://wpnews.pro/news/keeping-secrets-out-of-an-ai-chat-log-what-i-do-and-where-it-falls-short", "canonical_source": "https://dev.to/nicholasflemmer/keeping-secrets-out-of-an-ai-chat-log-what-i-do-and-where-it-falls-short-982", "published_at": "2026-10-19 15:02:29+00:00", "updated_at": "2026-10-19 15:14:28.012769+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": ["Styx"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/keeping-secrets-out-of-an-ai-chat-log-what-i-do-and-where-it-falls-short", "markdown": "https://wpnews.pro/news/keeping-secrets-out-of-an-ai-chat-log-what-i-do-and-where-it-falls-short.md", "text": "https://wpnews.pro/news/keeping-secrets-out-of-an-ai-chat-log-what-i-do-and-where-it-falls-short.txt", "jsonld": "https://wpnews.pro/news/keeping-secrets-out-of-an-ai-chat-log-what-i-do-and-where-it-falls-short.jsonld"}}