Security and Licensing: What to Never Paste, What to Review

AI makes you faster at writing code, including insecure code. This final lesson covers the risks that matter most for working developers: leaking secrets, shipping vulnerabilities, installing packages that do not exist (or worse, that an attacker created), and licensing problems.

Never paste these

• Secrets: connection strings with passwords, API keys, tokens, private keys, certificates
• Production data: customer records, emails, phone numbers, payment details, logs containing them
• Internal security details: firewall rules, credentials in scripts, vulnerability reports not yet fixed
• Code your company has not approved for external tools

Before pasting config or logs, replace secrets with placeholders such as ***. In .NET, keep secrets out of source in the first place: use user secrets (dotnet user-secrets) for development and environment variables or a vault (for example Azure Key Vault) in production. Ask the AI to show you how, so you never need to paste the real values.

If a secret is pasted or committed by mistake, treat it as leaked: rotate it (create a new one and revoke the old one). Deleting the chat or the commit is not enough.

Security mistakes AI often makes

AI learned from a lot of public code, including insecure examples. Review every suggestion for:

Ask the AI to review its own code for security:

Review this code for security issues as an OWASP-aware reviewer: injection,
broken access control, sensitive data exposure, insecure defaults. List
each issue with the line and a fix.

Then also use proper tools: .NET analyzers, dotnet list package --vulnerable, and your company's security scanners.

Check every package the AI suggests

AI sometimes invents package names that sound right but do not exist. Attackers have started publishing malicious packages under such made-up names, hoping someone installs them. Before adding any NuGet (or npm, PyPI) package suggested by AI:

• Search for it on nuget.org and check the owner, download count and last update.
• Prefer well-known packages, or the framework's built-in features.
• Check its licence fits your project.
• Ask: "Can this be done without a new package?" Often it can.

Licensing and ownership

• AI can occasionally reproduce code that closely matches existing open-source code, which may come with licence obligations. Some tools offer settings that block suggestions matching public code; ask your company whether these should be on.
• Follow your company's policy on AI-generated code in its products. Some companies require disclosure or extra review.
• Do not paste code from a client or another employer into AI tools without permission.

Agents need limits too

Coding agents can run commands. Give them the least access they need: a branch, not production; no production credentials; review commands before they run where the tool allows it. Never let an agent deploy or run database migrations against production without a person approving it.

Practice task

Pick one feature you built with AI help. Run a security review prompt on it, check every package it uses on nuget.org, search the code for secrets, and run dotnet list package --vulnerable. Fix what you find.

Then mark this lesson complete. You have finished the course!

Where to go next

• Sharpen your prompts with Prompt Writing That Works.
• See all free courses.

Key takeaways

• Never paste secrets, production data or unapproved code; rotate anything leaked.
• Review AI code for injection, access control, mass assignment and insecure defaults.
• Verify every suggested package on the official registry before installing it.
• Follow licensing and company policy, and limit what coding agents can do.