Clean up after a secret pasted into AI chat

A teammate is debugging a flaky Stripe webhook. They paste the whole failing request into a chat assistant and ask why the signature check fails. The paste includes the live webhook signing secret, a customer's email and the last 4 digits of a card. The answer helps, so they add the exchange to the team's shared prompt cookbook for others to reuse.

What is wrong here, what do you do now, and what workflow replaces it?