Skills and Privacy: How to Protect Your Data with AI

Privacy in the Age of AI-Assisted Development

Using AI for coding means sharing context with a language model. Skills can be a powerful ally for protecting your sensitive data, provided they are configured correctly.

Privacy Risks

What Gets Sent to the Model

When you use an AI assistant, the model receives:

• Your CLAUDE.md file content
• Files you open or reference
• Your conversation (prompts and responses)
• Project context (structure, dependencies)

Sensitive Data to Protect

• Secrets: API keys, tokens, passwords
• Personal data: Customer and employee information
• Intellectual property: Proprietary algorithms, business data
• Configurations: Infrastructure, server access
• Financial data: Revenue, margins, budgets

The Data Protection Skill

The Essential Guardrail

Integrate this skill in any project handling sensitive data:

## Data Protection Skill
ABSOLUTE RULES:
1. NEVER secrets (API keys, tokens, passwords) in code
2. NEVER real personal data in examples
3. NEVER credentials in logs or commit messages
4. Always use environment variables for secrets
5. Always anonymize data in tests

AUTOMATIC CHECKS:
- Before each commit: scan for secret patterns
- Before each push: verify no .env is included
- In code: alert if sensitive data patterns are detected

Patterns to Detect

## Sensitive Data Patterns
Alert if code contains:
- Strings resembling API keys (sk-, pk-, api_)
- Real email addresses (not test)
- Phone numbers
- Production IP addresses
- Database URLs with credentials
- Hardcoded JWT tokens
- SSL/TLS certificates

Protection Techniques

1. Secret Isolation

## Secrets Management
Configuration:
- .env file for local development
- .env in .gitignore (ALWAYS)
- Secrets manager for production (AWS SM, Vault)
- CI/CD variables for the pipeline
- Regular secret rotation

2. Data Anonymization

## Data Anonymization
For tests and examples:
- Use fictional names (John Doe, Acme Corp)
- Replace emails with test@example.com
- Use generated data (faker.js)
- Mask real amounts
- Replace IDs with generated UUIDs

3. Enhanced Gitignore

## Gitignore Security
Always exclude:
- .env, .env.local, .env.production
- credentials.json, secrets.json
- *.pem, *.key, *.cert
- config/local.* (local configurations)
- *.sqlite, *.db (local databases)
- node_modules/ (dependencies)
- .claude/ (personal configuration)

4. Pre-commit Hooks

## Pre-commit Security
Configure hooks that verify:
- No secrets in code (gitleaks, detect-secrets)
- No sensitive files added
- No TODOs containing sensitive information
- Reasonable file sizes (no DB dumps)

GDPR and Skills

Compliance by Default

## GDPR Skill
For any personal data processing:
- Minimization: collect only what is necessary
- Pseudonymization: replace direct identifiers
- Encryption: AES-256 at rest, TLS in transit
- Right to erasure: deletion function implemented
- Consent: traced and verifiable
- Registry: document each processing

Data Subject Rights

## Data Subject Rights
Mandatory implementation:
- Right of access: personal data export
- Right to rectification: data modification
- Right to erasure: complete deletion
- Right to portability: export in standard format
- Right to object: processing opt-out

Best Practices by Environment

In Development

• Use test data, never production data
• Mock external services
• Isolate development environments

In Staging

• Anonymized data from production
• Restricted and traced access
• Same security level as production

In Production

• End-to-end encryption
• Logging without personal data
• Sensitive data access monitoring
• Encrypted backup with rotation

Privacy Audit

Quarterly Checklist

1. Review secret access
2. Rotate keys and tokens
3. Scan code for exposed secrets
4. Verify .gitignore
5. Test data deletion procedures
6. Update GDPR registry
7. Train the team on best practices

Conclusion

Privacy is not the enemy of AI productivity. With the right skills, you can use AI safely while protecting your sensitive data. It is a matter of discipline, not restriction.

Explore our security skills and our best practice guides for responsible AI usage.