Secret Detection

How It Works

XAEIO automatically scans chat messages before sending them to detect sensitive data like API keys, passwords, and tokens.

Detected Patterns

• API Keys — OpenAI (sk-...), Anthropic (sk-ant-...), Stripe (sk_...), Google, AWS
• Passwords — Keywords like password, passwort, pw, secret followed by values
• Tokens — Bearer tokens, JWT tokens, access tokens
• Connection strings — Database URLs with credentials
• Private keys — RSA/SSH private key blocks

What Happens When Detected

1. A warning dialog appears before the message is sent

2. The detected secrets are highlighted

3. You can choose to:

- Save to .env — Move the secret into an environment variable, which is where it belongs; the message goes out without it

- Ignore — Leave the message unsent and deal with it yourself

- Ignore & send — Send the original message with the secret in it (not recommended)

The dialog does not mask anything. The useful option is the first one: the secret becomes an environment variable the generated code can read, and the chat never carries it.

Best Practices

• Use the Environment tab for API keys and credentials
• Tell the AI: "Use the STRIPE_API_KEY environment variable" instead of pasting the key
• Different keys for Dev and Prod environments
• The AI never hardcodes secrets — it always uses environment variable references

Environment Variables

Manage secrets safely in the Environment tab:

• Separate values for Dev and Prod
• Variables are injected at runtime, never committed to code
• Integration-managed variables (like DATABASE_URL) are read-only