What to Mask Before Sending Code to AI or ChatGPT

Information to look for first

The top things to check are API keys, access tokens, cookies, private keys, passwords, and connection strings. It's not always safe to just hide some of it, so remove it from your code completely.

Next, check customer names, email addresses, internal domains, IP addresses, hostnames, project names, and file paths. These details often remain in comments, exception messages, and test data.

• Environment variable values and configuration files
• HTTP headers, URL query strings, and log output
• Real data embedded in SQL or JSON
• Screenshot or attachment name

Steps to prepare safely

1. Copy only the minimum amount of code that can reproduce the problem into your working text.
2. Remove credentials and personal information first. Revoke and reissue any affected keys if necessary.
3. Mask identifiers, strings, numbers, and comments with tools that match your code format.
4. Search the output for original proper nouns, then confirm that no sensitive information remains and that the syntax is still intact.

Examples where masking alone is not enough

Company names or production URLs in the question—and notifications visible in a screenshot—can still disclose information even when the code itself is masked. Review the entire message and every attachment as a single package before sharing.

If you accidentally send confidential information, don't just delete the conversation; follow your organization's procedures, including revoking credentials, checking access history, and contacting your administrator.

Develop Tools processing takes place within the browser. However, it is safest to delete your credentials before entering them into the tool.

Specific example: Consulting AI for API call code

For example, code that consults for authentication errors may simultaneously include the Authorization header, API hostname, customer ID, and logged email address. Check not only error lines, but also constants, settings, comments, and exception messages.

After replacement, check whether "the same value becomes the same dummy value." If a customer ID appears on multiple rows but changes to different values, the relationship in the processing becomes unclear.

1. Copy only the classes and functions necessary for the consultation into the new text.
2. Search for API keys, tokens, URLs, IP addresses, names, and email addresses.
3. Mask identifiers and strings and check if syntax and equivalence relationships remain.
4. Search the completed code again for "secret", "token", "password", "company name", etc. and then share it.

If secret information has ever been sent externally, deleting it is insufficient; API keys and tokens must also be revoked and reissued.

Frequently asked questions

Is it safe to change only variable names?

It's not necessarily safe. Please review the entire code, as the organization name and credentials remain in strings, comments, URLs, exception messages, SQL, and test data.

Can the code after masking be executed as is?

It can be used to confirm the structure, but it does not guarantee feasibility. Visually check whether the reproduction conditions necessary for consultation remain, and store the original code separately.