Developer stores deploy SSH key in password manager vault after accidental AI chat exposure

A developer shared how a close call — accidentally pasting a private SSH key into an AI chat to verify its identity — prompted a complete rethink of key storage practices. Although the key had not yet been deployed and was immediately rotated, the incident highlighted that any exposure of raw private key material must be treated as a compromise. The developer now stores their most sensitive deploy key exclusively inside an encrypted password manager vault, which serves the key to SSH only upon manual approval, without ever writing it to disk. To bridge the password manager's Windows-side SSH agent with a WSL2 Linux environment, they used npiperelay.exe and socat to relay the connection through a Unix domain socket. The key takeaway is to verify SSH key identity using fingerprints rather than raw key material, and to reserve vault-gated secrets for credentials where the risk of exposure justifies the added friction.