Secret Detection

How It Works

Airbuild scans your chat messages for sensitive data — API keys, passwords, tokens — and flags what it finds so you can move it into an environment variable.

Detected Patterns

• API Keys — OpenAI (sk-...), Anthropic (sk-ant-...), Stripe (sk_...), Google, AWS
• Passwords — Keywords like password, passwort, pw, secret followed by values
• Tokens — Bearer tokens, JWT tokens, access tokens
• Connection strings — Database URLs with credentials
• Private keys — RSA/SSH private key blocks

What Happens When Detected

1. A banner appears in the chat with the value masked and a suggested variable name

2. The message itself is neither held back nor redacted — it has already gone to the model

3. You can choose:

- Save to .env — store the value as an environment variable the generated code can read, so from then on you point the AI at the variable name instead of pasting the key

- Ignore — close the banner and leave everything as it is

Nothing in the message is masked, and no option un-sends it. If the model should never see a value, take it out of the text before you send — and rotate any key that has already gone through the chat.

Best Practices

• Use the Environment tab for API keys and credentials
• Tell the AI: "Use the STRIPE_API_KEY environment variable" instead of pasting the key
• Different keys for Dev and Prod environments
• The AI is instructed to reference environment variables instead of hardcoding secrets, and the secret scan that runs before publishing blocks the release if a key ends up in the code

Environment Variables

Manage secrets safely in the Environment tab:

• Separate values for Dev and Prod
• Variables are injected at runtime, never committed to code
• Integration-managed variables (like DATABASE_URL) are read-only