Your AI Assistant Is Great at Code. It's Terrible at Keeping Secrets.

I have a confession. I recently reviewed a pull request from a developer who used an AI assistant to scaffold a quick integration with a third-party service. The code worked. The tests passed. The review was clean except for one thing: a live API key sitting right there in the source file. The assistant had helpfully generated a line like const API_KEY = "sk_live_abc123..." and the developer, trusting the machine, committed it.

This is not an isolated incident. It is becoming a pattern. AI coding assistants are trained on vast amounts of public code, and a lot of that public code contains secrets. When you ask for a quick example, you often get a quick example with a hardcoded credential. The assistant does not know your environment. It does not know you have a secrets manager. It just knows that this is how it has seen other people do it.

And that is the problem. Secrets in source code are a configuration failure, not a coding failure. But AI assistants are optimized for coding, not configuration. They will happily produce a working snippet that is a security incident waiting to happen.

Why this keeps happening

The root cause is not laziness. It is abstraction. When you are deep in a feature, juggling ten files and a deadline, a hardcoded string feels like the fastest path to done. The assistant reinforces that feeling by making it even faster. You type a comment like // call the payments API and it returns a full function with a placeholder key. You replace the placeholder with your real key and move on. You tell yourself you will fix it later. Later never comes.

The other cause is that environment variables are boring. They require a .env file, a deployment configuration, and a mental shift from "this works on my machine" to "this works everywhere." AI assistants do not nudge you toward that shift. They nudge you toward the snippet that runs right now.

The fix is not complicated, but it is not automatic

You need to move secrets out of source and into the environment. That means using something like process.env.API_KEY in Node.js, os.environ.get("API_KEY") in Python, or System.getenv("API_KEY") in Java. It means creating a .env file for local development and adding it to .gitignore. It means using your hosting provider's secret store for production.

Here is what the bad pattern looks like in a Node.js service:

// BAD: secret is in source control forever
const STRIPE_KEY = "sk_live_51H8...";

async function chargeCustomer(amount) {
  await stripe.charges.create({
    amount,
    currency: "usd",
    source: "tok_visa",
    api_key: STRIPE_KEY,
  });
}

The fix is a two-line change plus a config file:

// GOOD: secret comes from the environment
const STRIPE_KEY = process.env.STRIPE_KEY;

if (!STRIPE_KEY) {
  throw new Error("STRIPE_KEY is not set");
}

And a .env file that never gets committed:

# .env (add this file to .gitignore)
STRIPE_KEY=sk_live_51H8...

That is it. No magic. No new tool. Just a boundary between code and configuration.

What to tell your AI assistant

You can train your assistant to do better. When you prompt for a new integration, add a line like "read all secrets from environment variables, never hardcode them." Most modern assistants will follow that instruction. Some will even generate a .env.example file for you. But you have to ask. The default is still the dangerous default.

You should also scan your code before you commit. Tools like git-secrets, trufflehog, or gitleaks can catch a hardcoded key in a pre-commit hook. GitHub and GitLab both offer secret scanning on push. Turn it on. It takes five minutes and saves you a very bad day.

My take

I think we are in a weird moment. AI assistants have made writing code faster than ever, but they have not made configuring code any safer. In fact, they have made it easier to skip the boring parts. That is a recipe for leaked keys, surprise bills, and incident response at 2 a.m.

The good news is that the fix is small. Move the secret. Check the env var. Scan before you push. Do not let a helpful autocomplete turn your repository into a credential dump.

If you want a starting point for environment-based configuration, Seaworthy offers a minimal dotenv-style loader with validation for Node.js projects.