Log inStart free

Lesson 6 of 6 · 10 min · 1 hands-on step

AI at Work: Privacy, Security & Licensing

What you must never paste into an AI tool, and how to protect yourself and your employer.

Rule 1: know your company's AI policy

Every serious company now has rules about AI tools: which ones are approved, and what you may share. Ask on day one. Breaking them can cost you the job.

Never paste

  • Secrets: passwords, API keys, tokens, private keys
  • Personal data: customer names, emails, addresses, health or payment info
  • Confidential business info: unreleased plans, financials, private source code (unless the tool is approved for it)

Some tools may use what you type to improve their models, or store it where others could access it. Once it's sent, you can't take it back.

Secrets in code are a security incident

JavaScript · try it
// ❌ Never commit this. Bots scan GitHub for keys within minutes.
const apiKey = "sk-live_51H8x...";

// ✅ Read secrets from the environment
// const apiKey = process.env.PAYMENT_API_KEY;
console.log("Keys belong in environment variables, never in code.");

If you ever commit a secret, rotate it immediately (create a new key, revoke the old one). Deleting the commit isn't enough; it's already in the history and possibly copied.

Licensing and ownership

AI-generated code can occasionally reproduce code from its training data. For anything substantial:

  • Check whether it closely matches an existing open-source project and its license
  • Follow your company's rules on AI-generated code
  • You are responsible for what you commit, regardless of who or what wrote it

Security review of AI output

AI-written code often skips input validation, error handling and authorization checks. Before merging, ask: Could a user abuse this? What if the input is huge, empty or malicious? That one habit prevents most AI-introduced vulnerabilities.

🧪 Practice

Before sending text to any AI tool, strip sensitive data. Write redact(text) that replaces:

  • email addresses with [EMAIL]
  • API keys that start with sk- followed by 10+ letters, digits, - or _ with [SECRET]
  • 16-digit card numbers (optionally grouped by spaces or dashes, like 4242 4242 4242 4242) with [CARD]
JavaScript
function redact(text) {
  return text;
}

Output appears here. Press Run or Ctrl/⌘ + Enter.

✅ Check your understanding

  1. Which is safe to paste into a public AI chatbot?

  2. An AI tool generated a large block of code that looks copied from a project. What should you do?

Create a free account to track your progress.