Some strings are worth more than the code around them.
Secret
Also called API key, credential, token
A value that grants access: a password, an API key, a signing key. It belongs outside the code, in an environment variable or a secret manager, and it should only ever be readable by what needs it.
Agents want things to work, so a key pasted into a chat can end up in a config file, a test, a log line or a commit. Anything committed stays in the history, even after you delete the line.
Say it to your agent
“Read the key from process.env.STRIPE_KEY, add .env to .gitignore and commit a .env.example with the name and no value. Never print it, and if it's ever been committed, stop and tell me so that I can rotate it.”