AI Productivity Safety

Build the mental model

AI safety comes down to two ordinary habits: knowing what you paste, and knowing what you trust. Both fail quietly, with no crash and no error, which is what makes them dangerous.

Habit	Why it matters
Paste မလုပ်ခင် Check	Once text leaves your device, you generally cannot revoke it
Output ကို Verify	An AI tool's confidence has no necessary connection to accuracy

Passwords, API keys, other people's personal data, confidential company documents, and internal-only material all belong on a blocklist checked before pasting.

text

BEFORE YOU PASTE INTO AN AI TOOL
--------------------------------
BEFORE YOU PASTE INTO AN AI TOOL
-----------------------------------
              [content to paste]
                      |
                      v
   contains secrets / credentials / personal data?
        |                                   |
       yes                                  no
        |                                   |
        v                                   v
[STOP - remove or replace it]        [safe to paste]

Connect it to a real scenario

Before pasting anything into an AI tool, scan the text for password/API-key/credential shapes, personal data you lack permission to share, and confidential documents.

If it fails, remove sensitive fields entirely or replace them with placeholders
If you plan to use the output, run a separate verification pass
Open every citation to confirm it — do not trust a citation just because it looks properly formatted

Treat both habits as a permanent checkpoint, not a one-time judgment call — the failure mode is quiet, so the habit runs whether or not anything feels risky.

Once content leaves your device, you generally cannot revoke it
An AI tool's confidence has no necessary connection to accuracy — always verify
AI should only assist work, never silently become the source of truth

AI should never silently become the source of truth

AI can assist, draft, summarize, search, and accelerate work, but never treat a fact as trustworthy just because it has not been verified yet. The moment an unverified claim gets treated as settled fact, the system has quietly failed at the one job safety is supposed to do.

Before Pasting Into an AI Tool

No passwords, API keys, or credentials
No other people's personal data without their consent
No confidential company documents
Comfortable with this content leaving your control
Verified the tool's own data-handling policy if it matters for this content

Try the working example

javascript

function scanForSecrets(text) {
  const patterns = [
    { name: "API-key-shaped token", regex: /\b(sk|pk|ghp|xox[baprs])-[A-Za-z0-9_-]{16,}\b/g },
    { name: "password-looking assignment", regex: /\b(password|passwd|pwd|secret)\s*[:=]\s*\S+/gi },
    { name: "email + password pair", regex: /[\w.+-]+@[\w-]+\.[a-z]{2,}\s*[,/|]\s*\S{6,}/gi },
  ];

  const findings = [];
  for (const p of patterns) {
    const matches = text.match(p.regex);
    if (matches) findings.push({ type: p.name, count: matches.length, examples: matches });
  }
  return findings;
}

const risky = `
Here is the config so you can help me debug it:
api_key: sk-live-51Hh2eKZvKYlo2CkQnvIu9v1a2b3c4d5e6f7g8h
password: Sunshine2024!
Also contact: myboss@company.com / hunter22admin
`;

const clean = `
Can you help me rewrite this paragraph to sound more concise?
The system should support daily review and quick capture.
`;

console.log("Risky text findings:");
console.log(JSON.stringify(scanForSecrets(risky), null, 2));
console.log("Clean text findings:", scanForSecrets(clean));

You should see

Risky text findings:
[
  { "type": "API-key-shaped token", "count": 1, "examples": ["sk-live-51Hh2eKZvKYlo2CkQnvIu9v1a2b3c4d5e6f7g8h"] },
  { "type": "password-looking assignment", "count": 1, "examples": ["password: Sunshine2024!"] },
  { "type": "email + password pair", "count": 1, "examples": ["myboss@company.com / hunter22admin"] }
]
Clean text findings: []

The risky example trips all three patterns; the clean example flags nothing.

5-minute try-it

Run scanForSecrets() against a sample config file or message shaped like your own (use fake values, never real secrets). For each pattern it flags, write down how you would redact it before pasting into an AI tool.

One important caution

Pasting content without scanning it, just hoping by eye that no secret is in there

Reusing an AI's confident-sounding fact, date, or citation elsewhere without verifying it

NIST AI Risk Management Framework — Productivity Systems