Secrets, Security, and Licenses

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand secrets, security, and licenses without the fear factor
Get hands-on and try it yourself
Learn to spot (and smile past) the common mistakes

AI can slip in keys, personal data, or code with an unknown license. Learn how to shut that down.

Let's think about it this way for a sec

Models can memorize snippets from their training data and reproduce them. And if you paste a secret into a prompt, it can end up in a log somewhere. The security rule for vibe coding is simple: keep keys in .env, never in a prompt. If AI adds an unfamiliar npm package, read what it actually does. Question any copyleft license. And never use real user passwords, medical records, or financial data as examples.

Connecting it to everyday life

Even if AI puts in a fake key like sk-xxxx, don't copy that pattern into real code. Check that .env.local is in your .gitignore. Don't just tell it to 'add a useful library' — name the specific one you need. Check generated comments for anything that looks copied from another company's code. If you're suspicious, delete it and write it yourself.

Don't put secrets in prompts or in git
Read up on a new dependency before adding it
Don't use real user data as an example

Let's try it together

text

Never paste into a prompt:
- API keys and tokens
- Real emails, phones, addresses
- Production database URLs
- Customer content

Safe instead:
- Fake title “Note one”
- Env name NOTES_API_KEY (not the value)
- Redacted stack traces

You should see

You'll be able to spot and remove secret/license risks in AI prompts and PRs.

5-Minute Try-It

Write a bad prompt (one that includes a key). Explain why it's risky, then write the fixed version.

A Quick Word of Caution

Never treat AI output as automatically correct. Have a human read through the code and test it — and double-check secrets and user data — before you rely on it.

Easy traps

Asking AI to 'read and edit' your .env file
Installing a package AI added without checking its npm page

Now Try It Yourself

Write a bad prompt (one that includes a key). Explain why it's risky, then write the fixed version.

You'll know it worked when: You'll be able to spot and remove secret/license risks in AI prompts and PRs.