Stage 8 of 10 · 6 lessons · ~2 weeks

Security and licences

Keep secrets and sensitive data out of prompts, check every dependency an AI suggests, recognise the insecure patterns it repeats, scan automatically, and respect licences, data settings and AI policies.

Start: What never goes into a prompt

Lessons· one lesson for each topic, in this order

Do this

Write your never-paste list and share it with your team or group.
Move any secret in your code into environment variables and rotate it if it was ever committed.
Add four concrete security rules to your instructions file.
Run a secret scanner and a SAST tool locally, then add both to CI.
Check one AI-suggested dependency on its registry before installing.
Read your tool's data settings and your employer's or university's AI policy.

Start with· follow one of these

GuideFree
Security-Focused Guide for AI Code Assistant Instructions
OpenSSF · Intermediate
Free guidance from OpenSSF on writing security instructions for AI coding tools
GuideFree
OWASP Top Ten
OWASP · Intermediate
The most common web security risks, which AI-generated code repeats

Practise

Web Security Academy
Free labs on SQL injection and XSS, so you recognise them instantly in review

Keep handy

Gitleaks
Scan your repository and its history for leaked keys before you push
Choose a License
What common open source licences require, in plain language

Also worth your time

Security (opens in a new tab)Read
How Claude Code's permissions and protections work, and the practices Anthropic recommends
OWASP Application Security Verification Standard (ASVS)Go deeper
A complete checklist of security requirements, for when you build something that matters

Before moving on: A never-paste list pinned by your desk, security rules in your instructions file, Gitleaks and Semgrep (or your stack's equivalents) running locally and in CI, and one AI-suggested dependency you checked before installing.

Tauseef's advice

Security with AI tools is mostly about habits you set once: secrets out of the project, a short list of concrete rules, scanners in CI and a pause before every new dependency. Set them up in an afternoon and they protect every session after.