Skip to main content

Security and secrets

Treat Cocoding AI prompts, screenshots, generated code, and project previews as product workspaces. Keep sensitive data out of places where it does not belong.

Cocoding AI code workspace for reviewing generated configuration files
Review generated code for placeholder environment variables before connecting real provider credentials.

Do not paste​

  • Production API keys.
  • OAuth client secrets.
  • Payment provider secret keys.
  • Database passwords.
  • Private customer data.
  • Confidential contracts or legal documents.
  • Internal infrastructure hostnames or credentials.

Safer patterns​

  • Ask Cocoding AI to use environment variables.
  • Use test-mode provider keys during development.
  • Redact screenshots before uploading.
  • Rotate any credential that was accidentally exposed.
  • Keep production secrets in your approved secret manager.

Safer prompt wording​

Ask for variable names and setup instructions, not real secret values:

Add Stripe checkout.
Use STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, and STRIPE_PRICE_ID_PRO as environment variables.
Do not hardcode any secret value.
Show a setup warning if the variables are missing.
Connect Supabase using SUPABASE_URL and SUPABASE_ANON_KEY in browser-safe code.
Use SUPABASE_SERVICE_ROLE_KEY only on server-side routes.
Document where each variable is required.

Screenshot redaction checklist​

Before attaching a screenshot, remove or blur:

  • Account emails and profile names.
  • API keys, webhook URLs, and OAuth client secrets.
  • Database hosts, usernames, and passwords.
  • Customer names, phone numbers, invoices, and payment details.
  • Internal dashboards, browser tabs, or infrastructure hostnames.

Prompt example​

Add Stripe checkout using environment variables for the secret key.
Use placeholder names in the code and document which environment variables are required.

If a secret was exposed​

  1. Rotate or revoke the credential with the provider.
  2. Remove it from prompts, screenshots, commits, and docs.
  3. Replace it with an environment variable.
  4. Check logs and generated files for copies.
  5. Test the app with the new credential in a safe runtime configuration.