The clipboard is the most-used secrets manager in the world
Every key gets copied at least once. The copy is what escapes, not the original.
A key starts life in a provider dashboard. To be useful it has to reach a file, a terminal, a CI settings page and a colleague. In practice all four hops are the same gesture: select, copy, paste.
Each paste is a new copy in a new place, and none of those places were designed to hold secrets. This is the failure mode that produces all the others — you cannot rotate what you cannot find, and you cannot find it because you never recorded where it went.
How it actually bites
Clipboard managers keep history by default
Most productivity clipboard tools store the last fifty entries, on disk, unencrypted, searchable. A key you copied in March is one search away in September.
It lands in shell history
export API_KEY=sk-… is a command like any other, and it goes into .bash_history or .zsh_history in plaintext. So does any curl with a bearer token pasted inline.
It gets pasted into chat
Sending a key to a colleague over Slack, Teams or email is the fastest thing to do, so it is what happens. It is now in a message store, an export, a compliance archive and a search index, and deleting the message does not reliably remove it from all four.
Any page can read the clipboard after a paste
The web platform gives a focused document access to a paste event. Paste a key into the wrong tab — or the right tab on a site that logs form input — and it has left your control.
What we do about it
Insert at the cursor, in the editor
The VS Code extension puts the value straight into the file you are editing. It never passes through the system clipboard, so there is nothing left behind to paste somewhere else by accident.
Generate the file instead of assembling it
Rather than pasting six keys into a new .env one at a time, the extension writes the whole file from the project you select. Six paste operations become none.
On-demand autofill, current tab only
When you do need a key in a web form, the extension fills it into the active tab and only when you ask. It never fills a password, one-time code, card, bank or national-ID field, never submits the form, and never touches a cross-origin iframe. A test greps the injected function for .submit( and .click( so that stays true.
Share without sending
A teammate gets access to the project, not a copy of the string. The key is re-encrypted to their public key, so what travels is ciphertext only they can open.
Try it against your own keys
The extension is free and works offline. Set a master password, import an existing .env, and see what the vault looks like before you decide to trust it with anything.