This lesson is being recorded
Every video of this course is being uploaded to my YouTube channel. Subscribe so you do not miss it.
Bruno Ashford @brunoashfordSubscribeModule 11 · Lesson 11.3 · 10 min
Passwords, Keys and Credentials
Keep passwords, API keys and tokens out of files, prompts and conversations, and give the agent access without exposing secrets.
Use ← → to move. The marker highlights text and the pencil draws on the slide; navigation locks while you annotate. Undo removes the last mark, Esc exits.
1Find secrets that are already exposed
Ask Claude to scan your business folder for anything that looks like a password, API key or token, without printing the values. You may be surprised.
Scan this folder for anything that looks like a password, API key, token or private key, including in .md, .txt, .csv and .json files. Do not print any secret values. List only the file path, the line number and the type of secret, so I can move them to my password manager.2Move them to a password manager and rotate
Move every secret you find into your password manager and delete it from the file. If a key has ever been pasted into a chat or a shared folder, rotate it: create a new one in the service's dashboard and revoke the old one. Rotation takes five minutes; a leaked key can take months to clean up.
3Block the agent from reading secret files
Add deny rules for the places secrets live. A Read deny rule also stops the file being edited or created. Combine this with your .gitignore so secret files never end up in a shared repository.
{
"permissions": {
"deny": [
"Read(./.env)",
"Read(./.env.*)",
"Read(./secrets/**)",
"Read(**/*credentials*)"
]
}
}4Use connectors and scoped keys instead of passwords
When the agent needs a tool, connect it through an official connector or MCP server with its own sign-in, or create an API key with read-only or limited scope. Never give an agent your main admin password or your banking login. One key per purpose means one key to revoke if something goes wrong.
claude mcp list5Handle the special case of scheduled runs
Routines that run unattended still need to log in. Use the method from Module 10: a long-lived token created with claude setup-token, stored in a private file only your user can read, never inside the script or a shared folder. Write down where each token lives and when to renew it.
The most common security failure in small businesses using AI is not a clever attack. It is an API key pasted into a chat, a password saved in a notes file the agent reads every day, or a token committed to a shared folder. Once a secret has been in a conversation or a synced file, you should assume it is exposed.
The rule is short: secrets never go in prompts, CLAUDE.md, skills or shared files. They live in a password manager or in environment variables, the agent is blocked from reading secret files, and every key has the smallest permissions and a way to be revoked.
Key points
- A secret that has been in a chat or synced file should be treated as exposed.
- Secrets live in a password manager or environment variables, never in files the agent reads.
- Deny rules stop the agent reading secret files.
- Scoped, revocable keys beat admin passwords every time.
Avoid
- Pasting an API key into the conversation to get something working quickly.
- Saving passwords in CLAUDE.md so the agent remembers them.
- Using one all-powerful key for every tool.
- Not rotating a key after it was exposed because nothing bad happened yet.
An agency in Bristol ran the scan and found 11 secrets across its folders: ad platform tokens in a notes file, an email password in an old onboarding document, and a payment provider key in a CSV. None had been misused, but the payment key had full access. They moved everything to their password manager, rotated all 11, replaced the payment key with a restricted read-only one, and added deny rules. The whole exercise took an afternoon.