Notchlet found a possible secret in your chats.

A credential can end up in a transcript when you paste a .env file or an agent prints a command containing it. The conversation may also have been sent to your AI provider. Notchlet cannot tell whether the credential is still active or has been used by someone else.

Check the matched text in Notchlet. If it is a real credential, replace it and revoke the old one. It may also appear in backups, shared sessions or screenshots.

Notchlet scans files locally. It stores a hash and the first six and last two characters of a finding so you can identify it. It does not send findings to a server or test credentials against provider APIs.

1. 01

   Make a new key

   Create a replacement key with only the permissions your app needs. Store it in your secret manager or environment configuration. Check the service's rotation instructions before using a Roll or Regenerate action, since it may revoke the old key immediately.

   Sign in to the service the key belongs to. Look under Settings for something called API keys, Tokens, Developer or Credentials.

2. 02

   Update the apps that use it

   The old key is in at least one place: a .env file, a hosting dashboard (Vercel, Netlify, Railway and Render all call it Environment Variables), a GitHub Actions secret or a config file. Swap each one and redeploy.

   Not sure where it lives? Search the project for the first characters Notchlet showed you. In VS Code and Cursor that is Cmd Shift F.

3. 03

   Delete the old key

   After updating the apps that use the key, verify they work and revoke the old credential. If you suspect someone is actively using the exposed key, revoke it immediately and restore affected services with the replacement.

4. 04

   Look for damage

   Open the usage, billing or logs page and look for anything since the chat you do not recognize: requests from places you have never been, spend you did not cause, new users or keys you did not make.

   If you find unfamiliar activity, contact the service's support team. Include the affected credential identifier and dates, but do not send the credential itself.

5. 05

   Dismiss the resolved finding

   Once the credential has been revoked, choose Ignore in Notchlet. It remembers the finding by its hash and will not alert you again for the same value.

   Deleting a transcript does not revoke the credential. After revoking it, you can also remove local copies.

Do not paste a key into a chat. Put it in .env yourself and tell the agent the variable name. STRIPE_SECRET_KEY is all it needs to write the code.

Stop Claude Code from opening the file. Add this to .claude/settings.json in the project, or to ~/.claude/settings.json for every project:

{
    "permissions": {
        "deny": ["Read(./.env)", "Read(./.env.*)"]
    }
}

Claude Code then refuses to read those files with its own tools. It can still run cat in a terminal, so when a command touches .env, say no.

Use sandbox credentials during development when the service provides them. Add production credentials through your hosting dashboard or secret manager. Keep both out of chat messages.