ScrubLogsPasted an API key into ChatGPT? What to do next
Updated
It happens all the time: you paste a stack trace or a config file into ChatGPT, Claude, Gemini or Copilot to get help, and only afterwards notice the API key in the middle of it.
The risk is lower than pushing a key to a public GitHub repository, where scanners find it within minutes. It isn’t zero, though, and the fix takes five minutes.
Is the key actually exposed?
Treat it as exposed. A chat isn’t public, but the text you paste:
- is stored on the provider’s servers as part of your conversation history;
- may be reviewed by the provider’s staff or systems, for example for abuse monitoring;
- may be used to train future models, depending on your plan and settings;
- becomes visible to anyone you share the conversation with, or anyone who gets into your account.
Your company’s AI policy very likely forbids sharing credentials with these tools regardless of the risk, so you may need to report it anyway.
1. Rotate the key
Revoke the key and create a new one, then update wherever it is used. This is the step that actually removes the risk. Everything else on this page is clean-up. Our secret type pages have provider-specific steps.
2. Delete the conversation
Delete the chat from your history. This stops it showing up in your account and in shared links. Providers generally keep deleted conversations for a limited period for safety and legal reasons before removing them for good, which is why rotating the key matters more than deleting the chat.
If you shared the conversation by link, delete the shared link as well.
3. Check your data settings
Most AI chat apps have a setting that controls whether your conversations are used to improve their models. Business and enterprise plans usually exclude your data from training by default; free and personal plans often don’t. Check the setting, and turn it off if you handle work data in that account.
4. If customer data was in the paste
Logs often carry more than keys: emails, names, phone numbers, IP addresses, order details. If you pasted personal data about customers or colleagues into a third-party AI service, that may count as a data breach or an unauthorised disclosure under privacy laws such as the GDPR or the Philippine Data Privacy Act.
Tell your data protection officer or security team. They decide whether it needs to be reported. Some laws set deadlines as short as 72 hours, so tell them the same day.
Next time: redact before you paste
AI assistants don’t need your real keys or your customers’ emails to debug a problem. They need the structure: what happened, in what order, and which values were the same.
ScrubLogs replaces each secret with a consistent placeholder such as <AWS_KEY_1> or <EMAIL_2>, so the log still makes sense to the AI. It runs entirely in your browser; nothing you paste is uploaded. See how to share logs with AI safely for a full routine.