Never paste live secrets such as keys, tokens or passwords. Code is a judgement call that depends on your employer's rules and the tool's data settings. Redact first, check how the service stores and uses chats, and rotate anything that slipped through.
Treat a chat like an email to a third party
Once you send text, it sits on someone else's systems under their retention and training settings. Those settings vary by product and plan and they change. Read the current terms for the account you actually use, because a personal account and a company account often differ.
What never goes in
- API keys, access tokens and private keys
- Passwords and connection strings with credentials
- Customer data, personal data and anything under a contract that forbids sharing
- Unreleased security findings about your own systems
What is usually fine to paste
Small, generic snippets with names changed, error messages with hostnames and paths removed, and public code. If the question is about a pattern, rewrite the example so it contains no real identifiers.
How to redact quickly
Replace values with obvious placeholders. Swap real hostnames, account ids and email addresses. Search the text for strings that look like keys before sending. A pre-commit style secret scanner can be run over a snippet in the same way it runs over a commit.
If you pasted a secret
Assume it is exposed. Rotate it now, then check logs for use between the paste and the rotation. Deleting the chat does not undo what the service may already have stored. Tell your security contact, because a quick note costs nothing and an unreported leak can cost a lot.
Make the safe path the easy path
Teams do better when a written rule exists and an approved tool is available. People paste secrets into whatever is fastest. Give them a sanctioned option and a short list of what is off limits. If you want to see what is already in your own dependencies, Safeguard offers a free scan at https://gold.safeguard.sh/scan.
Quick check
Does deleting a chat remove a leaked secret?
No. Rotate the secret. Deletion does not guarantee the content is gone from every system.
Can I paste proprietary code into a work chat tool?
Follow your company policy and the tool's data terms for your plan. If you do not know the policy, ask before pasting.
Last reviewed: 19 October 2026.
