Keeping secrets out of AI prompts and logs
By the AgentReceipt team · Updated 13 November 2026
People paste errors into prompts. Errors often contain connection strings or tokens. If you log prompts, you may be logging secrets.
Where secrets sneak in
Common routes into a prompt:
- a stack trace that prints a connection string
- a copied environment file
- a command line with a token in it
- a config file the agent read and quoted back
Redact before you store
The safest time to remove a secret is before anything is written. AgentReceipt removes secret-like values from prompts and diffs before they are written to disk, and counts how many it removed so you can see it happened.
Limit what leaves your machine
Nothing is uploaded until you log in. When you do, your organization can choose to send only counts and flags, or the redacted prompts and diffs too.