Safe prompting checklist for developers

Use this checklist before every AI prompt that includes code, logs, or customer data. Print it, bookmark it, or keep SafePrompt installed so the easy mistakes are caught automatically.

Before you open the AI tab

• Is SafePrompt installed and set to Protected?
• Are you using Balanced mode for normal work, or Strict when handling payment-like numbers?
• Do you have a test/sandbox key instead of production?

Before you paste

• Look at the clipboard preview — is it a key, password, or token?
• Remove .env secret lines; keep only non-secret config
• Strip Authorization headers from logs
• Replace real emails/phones with fake examples when possible
• Never paste private keys (BEGIN PRIVATE KEY blocks)

While writing the prompt

• Describe the problem in words first, then add minimal code
• Use placeholders: sk-... → YOUR_OPENAI_KEY
• Do not include customer names, addresses, or card numbers
• If SafePrompt redacts something, read the toast before Undo
• Use Allow once only when you fully understand the risk

Before you press Send / Enter

1. Scan the prompt for anything that looks random and long (keys)
2. Check for emails and phone numbers
3. Check for internal URLs with tokens in the query string
4. Ask: “Would I be okay if this appeared in a support ticket forever?”

After a redaction by SafePrompt

• Confirm the placeholder still makes your question clear
• If the redaction broke context, rewrite with fake sample data
• Do not habitually click Allow once for convenience

If something sensitive was sent

1. Rotate the credential immediately
2. Notify your team if it was a shared secret
3. Review provider account activity
4. Update your checklist habits

Small habits that prevent big leaks

• Keep secrets in a password manager, not in random notes
• Use separate browser profiles for work vs personal AI
• Never sync production .env files to public AI
• Teach juniors: “AI is not your private vault”