How do you stop an LLM from leaking API keys in the code it writes? Default to secret

Pierre-Laurent Médori from GoodBarber shares a strategy to prevent LLMs from accidentally leaking API keys in generated code. Instead of relying on pattern-matching scanners, which often produce false positives or miss generic keys, the team implemented a 'default to secret' policy. The system requires the LLM to declare API keys and their transport methods as factual properties. A validation layer then enforces that any key is treated as secret unless it belongs to a provider-documented public category. By shifting the classification responsibility from the model's judgment to a strict, code-based rule set, the platform ensures that secrets are routed through a server-side proxy. This approach acknowledges that while models are effective at retrieving documented facts, they should not be trusted with security judgments, effectively minimizing the risk of credential exposure while maintaining functional flexibility for developers.