Codex Avoid Secret Leak Checklist: quick fix, steps, and deep guide

Q: Codex Avoid Secret Leak Checklist

Treat this as a Codex checklist issue. Confirm the environment, inputs, permissions, logs, and delivery boundary, then use the linked deep guide for the full checklist.

What is the problem?

一份给 AI 工具新手使用的 Codex 密钥安全检查清单，覆盖材料接收、脱敏、工具上下文、diff 审核、提交记录、交付说明和人工复核。

Quick solution

Treat this as a Codex checklist issue. First confirm the environment, inputs, permissions, logs, and delivery boundary. Then use the linked deep guide for the full checklist before changing production code or promising a result.

Read the deep guide

Detailed steps

客户是否说明了任务目标、验收标准、环境范围和截止时间？
是否明确这是测试环境、预生产环境还是生产环境？
是否涉及 API key、数据库连接串、Webhook secret、云服务 token、账号密码、服务账号文件或支付配置？
是否涉及真实用户数据、订单、邮箱、手机号、日志、截图或内部接口？
是否需要登录、绑定、授权、开通服务、重置密钥或修改后台权限？
`.env` 文件：保留变量名，删除真实值。

Commands or code

请基于脱敏材料分析问题。
不要生成真实密钥，不要要求我提供账号密码或生产 token。
如果下一步需要登录、授权、开通、付款、重置密钥或访问生产数据，请停止并列出人工确认事项。

Risk notes

Confirm the real project environment, account permissions, platform rules, and output quality before delivery. Do not ship AI-generated changes without human review, and do not claim indexing, income, deployment success, or ranking improvements without measured evidence.