Skip to content
VibeSafeDaily

LibrarySecrets

A secret was pasted into the Emergent chat

Cataloged October 17, 2026 · Emergent

Symptom

The agent asked for a key, the real value went into the prompt, and that value is now in the chat instead of the Secrets tab.

Root cause

Emergent's keep-it-safe page says anything typed in chat is sent to the AI provider, so a real secret must not be pasted there. Preview secrets live in .env files, and the agent can see those files, including .env, in preview. Production secrets live in the Secrets tab under Preview, then Manage. System keys are platform-managed. Custom keys are yours. The first Publish copies .env values into production; after that the two sets are separate, and a preview edit does not change the live value. New keys are added by asking the agent to create the name in .env, then you put the real value in yourself. For a live app that is Preview, Manage, Secrets, edit the Custom key, Save, and re-publish. The page says the agent never sees production secret values from the Secrets tab. It also says anyone with publish access can reveal a secret value. If a secret was already pasted in chat, the page says to add the key the proper way and rotate it at the provider.

Fix prompt

Do not repeat any secret in this chat, and do not ask me to paste one.

1. If I already pasted a key, token, or password into this chat, tell me to rotate it at the provider. Do not quote the value back.
2. Add only the key name to .env. Leave the value empty for me to fill in.
3. Tell me the production path: Preview, Manage, Secrets, Custom keys, Save, then re-publish. Do not invent a way to create a new production key from the Secrets panel. New keys start as a name in .env and are picked up on the next re-publish.
4. Do not hard-code the value in client-side JavaScript or HTML.

Stop after the name is in place.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

  1. Read your own Emergent chat. If a real key, token, or password appears there, rotate it at the provider before you do anything else.
  2. In your own project, confirm the live value is a Custom key under Preview, Manage, Secrets, and that the chat only contains the key name.
  3. Publish access can reveal secret values. Remove anyone who should not have that access on your own project.

Sources

Same symptom