Original Reddit post

I was a few hours into writing a security playbook when it happened. I needed to authenticate a tool for research, and the clean auth path had a couple of extra steps. The fast path was: open dev tools, copy the cookie header, paste it straight into the chat. I took the fast path. Twice — once when the session expired mid-task. These weren’t scoped API keys. Sixteen cookies together = my entire Google account, sitting in plaintext in a chat transcript. The AI agent flagged it immediately and pointed out the irony: I was, at that exact moment, writing about credential discipline. The failure didn’t feel like a failure. It felt like getting unblocked. That’s the dangerous part. The paste was a symptom — the real problem was that nothing in my workflow was positioned to catch it. The careful path had friction; the fast path didn’t. When that’s the layout, the fast path wins every time. I wasn’t alone either — a 2025 security audit found that 65% of top private AI companies had leaked API keys or tokens on public GitHub repos. The people leaking credentials aren’t the sloppy ones. They’re the fast ones. So I built a gate: session tokens and API keys never go into a chat window, full stop. If a tool needs auth, it gets it through its own login path. No fast-path exception — because the fast path is exactly where this happens. The tokens were rotated and nothing was lost. But “it was caught” is luck wearing the costume of a process. Write the gate down before you need it. https://trupathventures.net/labs/field-notes/i-pasted-my-session-tokens submitted by /u/FewConcentrate7283

Originally posted by u/FewConcentrate7283 on r/ClaudeCode