62Secrets and keys

If you skip everything else - read this.

An access key is a password to some service. To your AI, your database, your payments. Whoever has it can do everything you can. Including spending your money.

The main rule: keys never live in the code. They live in a separate file that doesn't go into history and doesn't travel to the internet. Tell the AI that at the start of the project and it will set it all up correctly itself.

Why this is so serious. Bots crawl the internet around the clock looking for exposed keys. Not "someone might notice eventually" - they find them in minutes. A public repository with a key inside empties an account faster than you can make tea.

And this isn't scaremongering. In January one application exposed a million and a half access keys, thirty-five thousand email addresses and users' private messages - within three days of launching. An audit of fifty AI-built applications found the database wide open in almost nine out of ten. And research suggests roughly forty-five percent of AI-written code fails basic security checks.

The conclusion isn't "don't use AI". The conclusion is: AI doesn't think about security on its own unless you ask it to. So ask. Directly: "check whether there are holes here", "check that secrets aren't getting into the repository". It knows how; it just doesn't do it by default.

And I had my own incident: an access key once ended up written somewhere it shouldn't have been. Dealing with the aftermath took several days. Five minutes of attention at the start is cheaper.