15 min · up to 70 XP

Security smells

The five vulnerabilities AI loves to write.

Sam's app can now fetch book covers from an online service. The AI's code worked first time. She's delighted. But this lesson is about a new kind of wrong: nothing crashes, nothing miscounts, every check you've learned so far comes back green.

Security flaws don't fail. They sit quietly in working code, waiting for the wrong person to read them. You don't need to be a hacker to catch the common ones. You need a nose. Sniff this.

Spot the bug

This runs perfectly, and always will. Click the line a security reviewer would circle in red. (The key is fake. Ours always will be.)

Click the line you think is wrong.

1const API_KEY = "sk-XXXX-XXXX";
2 
3function fetchCover(title) {
4  const url = "https://covers.example.com?q=" + title;
5  return fetch(url + "&key=" + API_KEY);
6}

Smell one: secrets in code. Code travels (pasted into AI chats, shared with helpers, pushed to public repositories) and a key written inside it travels too, every single time. The rule: secret values live in settings outside the file; the code only refers to them.

But hardcoded keys are just the first smell. Sam sketches a map of her app, and three dangers are sitting in plain sight.

This lesson is part of the full course

The free lessons are just the opening chapter. Unlock the rest of Code with AI to keep going.

Every Code with AI lesson, as it ships
New interactive lessons added monthly
Founding-member pricing, locked in
Learn at your own pace, forever

or keep browsing the free lessons