Stop pasting secrets into Slack

A contractor needs your production Stripe key by end of day. Someone in support is locked out of staging. Your teammate is stuck and you have the one password that unblocks them.

You paste it into Slack. Or Jira. Or email. One message, one person, done.

Except it is not done. That secret is now sitting in a searchable archive forever. Six months from now, a new hire scrolling #incidents can find it. So can Slack's export. So can whatever backup tool your company runs. Mobile notifications put it on lock screens. Someone screenshots the thread and forgets about it.

Nobody meant to create a credential leak. They meant to unblock someone. Chat just happens to be the fastest place to type, and "delete this message later" never actually happens.

The actual fix is boring

You do not need a security review for a one-off handoff. You need the secret to exist somewhere for a few hours, then disappear.

That is what encrypted link tools do - PrivateBin, Bitwarden Send, Nullo, others in the same family. You encrypt the text on your device, set an expiry, upload ciphertext, and send a link. The decryption key sits in the URL fragment (the part after #), which your browser keeps and the server never sees. The recipient opens the link, their browser decrypts it, they copy the secret, and the link expires on the schedule you picked.

The catch is that most of these tools are slow enough that people skip them. Open a browser tab, log in, navigate to the right page, fill out a form... at that point Slack wins. We built Nullo as a menu-bar app with a global shortcut because we got tired of watching people take the fast bad option.

One habit change

Next time you are about to paste a password into a channel: would you be fine if everyone in that workspace could still read it a year from now? If not, send a link with a short expiry instead. Burn-after-read if it is genuinely one-time.

Slack stays useful for the conversation. It just stops being where your credentials go to die.