---
name: ahmed-pastes-secrets-caution
description: "Ahmed sometimes pastes real .env secrets into Telegram himself — flag it, don't repeat the values, don't over-alarm"
metadata: 
  node_type: memory
  type: feedback
  originSessionId: e76b8acc-b39e-441c-ad82-68c4ed982296
---

On 2026-07-04 Ahmed pasted the full contents of `/root/ultron/.env` (proxy creds, Supabase secret
key, DB password, dashboard password) into the Telegram chat, apparently by mistake while trying
to help with the Telegram-bot-token handoff for [[telegram-agent-migration]] — he grabbed the
wrong file and it wasn't even needed for that task.

**Why:** The global rule "never paste secrets into Telegram" is written for me, but he can (and
did) paste them himself. Telegram messages sit on Telegram's servers — more exposure surface than
the VPS filesystem — even though this is just his own private bot chat.

**How to apply:** When this happens: (1) don't echo/repeat the secret values back in the reply,
(2) note plainly that it wasn't needed / wrong file if applicable, (3) remind him to reference
secrets by key name and let me read the .env directly over SSH instead of pasting values, (4) ask
if he wants anything rotated out of caution, but don't rotate unprompted and don't over-alarm —
it's a contained, private chat, not a public leak.