CategorysafetyManual1.4Evidencedocumented
ProblemA tool or workflow asks for a password or API key in an ordinary chat message.
TechniqueStop and use the takeover instead. For API keys, use the supported secure secret request, where the value is masked, excluded from the transcript, and not shown to the model.
Why it worksChat messages and ordinary files are readable context; the secret request is not.
When to useAny credential, always.