A secret was pasted into the Replit Agent chat

Symptom

The agent asked for a key, you pasted it into the prompt, and now the value is in the chat history instead of Secrets.

Root cause

Replit's shared responsibility model says you own secrets management: use Connectors and the Secrets feature. It says not to paste API keys, tokens, or credentials into the chat, because the agent does not need them in plaintext and pasting turns a managed secret into an unmanaged one. You also own who can view secrets, and you own reviewing agent output before you ship. Replit says it does not store or log secrets in plaintext when they go through the Secrets tool.

Do not repeat any secret in this chat.

1. If a key, token, or database URL was pasted into the agent prompt, treat it as exposed and rotate it at the provider.
2. Store the new value in this Repl's Secrets tool, or in a Connector.
3. Read it from the environment in server code only. Do not hardcode it and do not prefix it for the client.
4. Remove the old value from source files if it was written into the repo.

Tell me the variable names you will read, not the values.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. Search your own Repl's files for a key prefix you recognize, such as sk_live or a pasted token.
2. Confirm the live value is in Secrets and the code reads the environment variable by name.
3. Rotate any credential that appeared in the chat, then update only the Secrets entry.

Sources

• Replit: Shared responsibility model