ConeheadAI · leftover lesson
SNK3-238 · Curriculum How-to
API key hygiene — the three rules
L3–L6 · Verifier–Architect (bootstrap — system rebalances) · ~5m
Look for this insight
Keys never go in shared prompts or client code, get rotated when exposed, and get scoped to least privilege.
Lesson hook
An API key is a password that spends money. Three rules cover most disasters: never paste keys into prompts, chats, or client-side code; rotate immediately if exposed; scope each key to the least access that works. Everything else is commentary.
Do this now
If you have any AI API key: check where it's stored, when it last rotated, and what it can access. No key? Write the 3 rules where your team will see them. You're done when one concrete improvement happened — a rotation, a scope cut, or the posted rules.
Completion check: one_concrete_key_improvement
Conehead-only — no external link
Staff review Sign in