Stage 8 · Lesson 1 of 6
What never goes into a prompt
Prompts and files the tool reads leave your machine, so some things never go in, whatever the tool's privacy settings say: , and passwords; private keys such as .pem files; .env files and cloud credentials; real customer, patient or student data; production database dumps and connection strings; employer code when policy forbids it; and exam or assignment questions where AI is not allowed.
Use fake data that has the same shape as the real thing, and redact logs before pasting them. Keep secrets in or a secrets manager so they are never in code at all. If a secret does leak into a prompt or a , rotate it straight away.
Common trappasting a log to get quick help without noticing it contains a live token and a customer's email address.
A question to check yourself, an AI practice session and 2 cheat sheet entries come when you add the roadmap to your account. Add it
Resources for this stage
Start with· follow one of these
- GuideFreeSecurity-Focused Guide for AI Code Assistant Instructions
OpenSSF · Intermediate
Free guidance from OpenSSF on writing security instructions for AI coding tools
- GuideFreeOWASP Top Ten
OWASP · Intermediate
The most common web security risks, which AI-generated code repeats