Privacy and Security

A login bug has you stuck, so you paste the config file and the last fifty lines of the server log into an AI assistant. It spots the problem in seconds. What you did not notice is that the log also held a customer's email address and the config held the production database password.

Maybe nothing bad ever comes of it. But that password now sits in a chat history on a server you do not run, kept for as long as that service keeps things, and visible to whoever can open your account. You gave away control of it to fix one bug.

#Pasted text leaves your hands

When you send a prompt to a hosted assistant, the text travels to the provider's servers to be processed. What happens next depends on the provider, your plan and your settings. It can be kept in your chat history, kept in logs for a while for abuse monitoring or debugging, and in some setups used to improve future models.

You do not need to fear this. You need to know the answers for the tools you use, once:

• Is this tool approved for this kind of data? At work, your employer may allow some tools for code and forbid them for customer data. Ask before you find out the hard way.
• Is my data used for training, and can I turn it off? This often differs between personal and business plans.
• How long are conversations kept, and does deleting a chat delete it everywhere?
• Who else can see my history? Shared workspaces, admins and shared devices all count.

#What to keep out

• Secrets: passwords, API keys, access tokens, private keys, connection strings.
• Other people's personal data: names with contact details, health, financial or student records. They did not agree to share it with a third party, and laws in many places say you need a reason to.
• Confidential work: unreleased plans, contract terms, code your employer has not cleared for the tool.

The model rarely needs the real value. To debug a login, it needs to know that a password is set, not what it is. Replace sensitive values with placeholders like [EMAIL] or [SECRET], and the help you get is the same.

#Redact before you paste

For logs and config files, a small script does this faster and more reliably than your eyes. Each rule replaces one known shape of sensitive text, in order.

// Rules run in order. Each replaces one known shape of sensitive text.
const RULES = [
  [/[\w.+-]+@[\w-]+\.[\w.]+/g, "[EMAIL]"],
  [/\b(\w*(?:password|secret|token|key))\s*[=:]\s*\S+/gi, "$1=[SECRET]"],
  [/\b[A-Za-z0-9_-]{32,}\b/g, "[TOKEN]"],
];
 
function redact(text) {
  for (const [pattern, replacement] of RULES) {
    text = text.replace(pattern, replacement);
  }
  return text;
}

import re
 
# Rules run in order. Each replaces one known shape of sensitive text.
RULES = [
    (r"[\w.+-]+@[\w-]+\.[\w.]+", "[EMAIL]"),
    (r"(?i)\b(\w*(?:password|secret|token|key))\s*[=:]\s*\S+", r"\1=[SECRET]"),
    (r"\b[A-Za-z0-9_-]{32,}\b", "[TOKEN]"),
]
 
def redact(text):
    for pattern, replacement in RULES:
        text = re.sub(pattern, replacement, text)
    return text

Step through the three rules on a five-line log.

for each (pattern, replacement) in RULES:  text = replace every match of patternreturn text

#Security risks that come back out

Privacy is about what goes in. Security is also about what comes out, because AI output often ends up running on your machine.

• Insecure fixes. Asked to "make the error go away", a model may suggest turning off certificate checks, opening permissions wide, or building a database query by gluing strings together. Each one works, and each one opens a hole. When a fix disables a safety check, find out why the check failed instead.
• Packages that do not exist. Models sometimes suggest plausible package names that were never published. An attacker can register such a name and publish a harmful package under it. Before you install anything new, check that it is the real, maintained project.
• Commands you have not read. Read a command before you run it, especially anything that deletes, changes permissions, or downloads and runs a script in one line.
• Assistants with access. An assistant that can read your files or act on your accounts can be steered by text hidden in what it reads. Prompt Injection covers how, and why you should give such tools only the access the task needs.

#Try it yourself

#Common mistakes

#Check yourself

#What to practise next

Look up the data settings of the assistant you use most, and write down the four answers from this lesson. Then continue with Choosing a Model, where privacy is one of the trade-offs alongside quality, speed and cost.