What Not to Paste: Privacy Basics

Beginner

Redact first, prompt second

01 The Concept

Pasting real material is the best way to get useful output — but real material carries real data: names, salaries, API keys, customer emails, unreleased plans. Once sent, you should assume it's outside your control. Many workplaces have policies about exactly this, and 'the AI needed context' is not a defense your security team will enjoy.

The good news: models don't need real identifiers to do great work. Structure matters; identities usually don't. Swap names for roles (ACME_CORP, CLIENT_A, my manager), keep amounts approximate when exact ones aren't the point, and never paste secrets — keys, passwords, tokens — under any circumstances.

02 Weak vs. Strong

EX 01Getting help with a sensitive HR situation

Draft a performance improvement plan for [EMPLOYEE], a senior engineer whose delivery has dropped significantly over the last quarter (missed 3 of 4 sprint commitments; two teammates raised code-quality concerns).

Constraints:

Focus strictly on observable work behaviors — no speculation about personal causes
30/60/90-day structure with measurable checkpoints
Tone: supportive and factual, written to help them succeed
Include the support the company will provide at each stage

I'll fill in names and specifics myself.

→ Why it works

The role, the observable facts, and the constraints carry all the signal. Name, email, salary, and personal circumstances added risk and zero quality.

EX 02Debugging with a config file

My app can't connect to Postgres. Here's my config with secrets redacted — the shapes are preserved:

DATABASE_URL=postgres://USER:PASSWORD@HOST:5432/DBNAME (real password contains @ and ! characters)

Error:

invalid port ":5432" after host

I suspect the special characters. What's the actual rule for special characters in connection-string passwords, and what's the safe fix?

→ Why it works

The bug is diagnosable from the shape alone — an unencoded @ splits the URL. The live Stripe key in the 'bad' version is a genuine security incident, not a prompt.

03 Key Points

01Assume anything you paste leaves your control — prompt accordingly

02Replace names with roles: CLIENT_A, VENDOR_B, 'our CFO' — output quality barely changes

03Never paste secrets: API keys, passwords, tokens, connection strings — no exceptions

04Company policy beats convenience: know whether your workspace allows real customer data in AI tools

05Redaction can be a prompt too: 'replace all names, emails, and amounts in this text with placeholders' (then check it yourself)

04 Model-Specific Notes

You can ask Claude to act as the redactor first: 'list every piece of identifying or sensitive data in this text before we continue.' It's thorough at spotting emails, names, and keys — but you remain the final check.

05 For Your Role

Asking about a medical bill, a lease dispute, or a tax letter? Swap your name, account numbers, and exact amounts for placeholders. The advice will be identical.

Next: Contrastive Few-Shot Prompting →