Guardrails for developers

When you finish, you can use AI on code without leaking secrets, shipping invented functions or hiding where code came from.

Stuck? Ask the AI tutor

What never goes into a chat box

Never paste passwords, API keys, tokens, private certificates or connection strings. Never paste customer records, even a few rows of a real database. If a log file contains names, emails or account numbers, remove them first. A consumer AI tool may store your input or use it in ways your employer has not approved.

Also think about source code. Many companies treat their code as a trade secret. Use only the tools your employer has approved, and follow its policy on what can be shared. If you are unsure, ask your security or engineering lead before pasting anything. Asking once is cheaper than explaining a leak later.

Hallucinated code and fake packages

Assistants sometimes invent functions, options or whole libraries that sound real. A package name that does not exist today can be registered by an attacker tomorrow, and a careless install then pulls in harmful code. Before you add any dependency an assistant suggests, look it up in the official registry and check who maintains it and how long it has existed.

Run the code. Read the documentation for any function you do not recognize. A good habit is to ask the assistant, “Which parts of this answer are you least sure of?” It will not always be right about its own doubt, but it often points you to the shaky spots.

Security and quality of generated code

Generated code can look neat and still be unsafe. Watch for string-built SQL queries, missing input checks, weak password handling, disabled certificate checks and overly broad permissions. Ask for secure versions explicitly, then review them yourself. Run your normal scanners, linters and tests on AI-written code exactly as you would on a stranger's pull request.

Keep changes small. A short diff you understand is safer than a thousand-line paste you skimmed. If you cannot explain a block of code to a teammate, it is not ready to merge.

Licenses, bias and disclosure

Know your employer's and your client's rules on generated code, including how licenses are handled. Some teams require you to note when a significant block came from an assistant. If a contract or school assignment forbids AI help, follow that rule. Honest disclosure protects you.

Bias shows up in software too. If you ask AI to write logic that scores, ranks or filters people, check it for unfair results across groups, and keep a human responsible for decisions that affect someone's job, money or safety. Learn to say no, politely, when a request is unsafe or unlawful.

Practice now

Write a half-page personal checklist titled 'Before I paste code into an AI tool' with at least six items. Include secrets, customer data, and approved tools.
Ask an AI tool for a small script that uses an external library. Look up that library in its official registry and note whether it exists, who maintains it, and what the real function names are.

Use any AI assistant you have. Do not paste private, client or patient information into it.

Check yourself

1. An assistant suggests installing a package you have never heard of. What should you do first?

2. Which of these is safe to paste into an unapproved chat tool?

3. What should happen to AI-written code before merge?

Ask the AI tutor

Ask anything about this lesson, in any language. The tutor is an AI: it can be wrong, and it never needs your personal details.

Next lesson: Grow with AI: your 30-day plan

AI-drafted. Checked by an automated validator and a separate AI reviewer; a person has not read every lesson. Translations and tutor answers are AI-made. Found a mistake? Tell us. AI can be wrong. General information only, not professional advice. Not affiliated with any AI company named. Current University is not accredited.