Passwords and API keys
How agents ask for a key without it landing in the chat.
Never paste a password or an API key into a chat message. A chat message is stored as text, everyone in the channel can read it, and it goes into the model's prompt.
Agents know this. When one needs a key, it opens a secure form in the chat instead of asking in a message. What you type there is encrypted before it is stored, and the agent never gets to read it back.
From then on the agent refers to the key by name, like {{secret.github_token}}, and the system fills in the real value at the moment it is used.
You can see every key your agents hold in Settings, and delete any of them. Deleting one takes effect immediately.