Assume it leaves your machine

Unless you are certain of the tool's data policy, treat anything you paste as sent to a third party and possibly retained.

Never paste

• API keys, passwords, database credentials, private keys
• Real customer data, names, phone numbers, ID numbers, payment details
• A client's proprietary source under a confidentiality agreement
• Anything from a system you do not own

Sanitise instead

Replace real values with placeholders. The structure is what matters for a useful answer:

// before
$pdo = new PDO('mysql:host=db5020447.hosting.io', 'u82914', 'Kx9!mQ2z');

// pasteable
$pdo = new PDO('mysql:host=HOST', 'USER', 'PASS');

If it has already happened

Rotate the credential. A key pasted into any third-party service must be treated as exposed, and rotating takes five minutes, while a compromise does not.

Client work has rules

Many contracts prohibit sending code to external services. Ask before assuming, and note that "I used an AI tool" is not a defence to a confidentiality breach.

Personal data has laws

Kenya's Data Protection Act, and the GDPR where it applies, govern where personal data may be sent. Customer records are not test data.