App security
Lesson 18 of 26 in the course “Vibe coding”. Free, with animations and a quiz.
Mistake 1: key in the code
AI writes code that works, but not always code that's safe. Example for this lesson: you built an AI homework helper for your grade. The figure shows common mistakes: a red cross, and next to it the fix with a check mark. Mistake 1: the key to a paid AI API sits in the frontend or a public repository. Bots scan GitHub nonstop and find keys fast. Key leaked? Revoke it in the service's dashboard right away and create a new one.
Mistakes 2 and 3: open doors
Mistake 2: a database without access rules, like RLS from the database lesson. Then anyone can download every student's data. Mistake 3: the admin panel, the page that manages the site, is hidden only by not showing a button. Anyone can still type the /admin address by hand. The “is this really an admin?” check must run on the server on every request, not just in the interface.
Mistake 4: trusting the browser
Mistake 4: trusting what the browser sends. Everything in the frontend is on the user's computer. With developer tools (the F12 key) they can change any request: the price, their id, the “admin” role. The rule: the server itself checks who sent the request and whether they're allowed, and it calculates prices and points itself. In the figure the server decides, not the browser.
Mistake 5: no limits
Mistake 5: no limits. Every question to the AI helper costs you money, and a bot can ask thousands overnight. A rate limit caps how many requests one user can make per minute; the rest get “please wait”. For example: 20 questions a minute per student is more than enough. Where the AI service allows it, also set a spending limit in its dashboard.
Mistake 6: leaky libraries
Mistake 6: leaky dependencies. Dependencies are other people's libraries that npm install downloads (the second line in the figure). Old versions get vulnerabilities found in them, meaning holes for attacks, so keep them updated. Use well-known packages. The trap: AI sometimes invents the name of a package that doesn't exist, and attackers register such names with malicious code. Unfamiliar package? Check that it's real and popular.
Personal data and review
Personal data is anything that can identify a person, like a name, email or phone number. Collect only what the app can't work without: a homework helper needs just an email. Write a short privacy policy: what you collect and why. Before launch, ask the agent: “review the project's security against this list”. But double-check its “all good” yourself by walking through the figure.
Check yourself
- Your AI API key ended up in a public repository. What do you do first?
Correct answer: Revoke the key in the dashboard and create a new one. Git remembers history, and bots may have copied the key already. Only revoking makes the old key useless. - The price arrived in a request from the browser. Can you trust it?
Correct answer: No, the server must calculate the price itself. The frontend runs on the user's computer, and they can change any request. Https protects the road, not the sender's honesty. - Why does an AI helper need a rate limit?
Correct answer: So a bot can't make thousands of paid requests. Every AI request costs money. A rate limit stops one user or bot from burning your budget.