Secrets, Security, and Licenses

AI can slip in keys, personal data, or code with an unknown license. Learn how to shut that down.

Let's think about it this way for a sec

Models can memorize snippets from their training data and reproduce them. And if you paste a secret into a prompt, it can end up in a log somewhere. The security rule for vibe coding is simple: keep keys in .env, never in a prompt. If AI adds an unfamiliar npm package, read what it actually does. Question any copyleft license. And never use real user passwords, medical records, or financial data as examples.

Connecting it to everyday life

Even if AI puts in a fake key like sk-xxxx, don't copy that pattern into real code. Check that .env.local is in your .gitignore. Don't just tell it to 'add a useful library' — name the specific one you need. Check generated comments for anything that looks copied from another company's code. If you're suspicious, delete it and write it yourself.

• Don't put secrets in prompts or in git
• Read up on a new dependency before adding it
• Don't use real user data as an example

Let's try it together

Never paste into a prompt:
- API keys and tokens
- Real emails, phones, addresses
- Production database URLs
- Customer content

Safe instead:
- Fake title “Note one”
- Env name NOTES_API_KEY (not the value)
- Redacted stack traces

You'll be able to spot and remove secret/license risks in AI prompts and PRs.