What you should never do

Coding with AI quickly gives you a feeling of power. That's exactly when costly mistakes creep in. Here are the ones beginners make most often, and how to avoid them.

1. Putting a secret in the code

An API key (the code that gives access to a paid service, like an AI model or a text-message service), a database password, a login: none of these should appear in a web page's code or in a file published online. Anything in a web page can be read by any visitor, and bots constantly comb public code repositories looking for forgotten keys. A key that's found can be used at your expense.

• Keep secrets in a separate file that's never published (often called ".env"), or in the settings your host provides for this.
• When you paste code into a conversation to ask for help, replace the real key with "MY_KEY".
• If a key has leaked, don't just delete it from the code: revoke it in the service concerned and create a new one.

2. Going live without understanding

Publishing means making your project accessible to everyone. Before you do, ask yourself three questions: what does this site store? Who can access it? What happens if someone types in anything at all? If you can't answer, ask the AI to explain, and don't publish until it's clear. A purely informational page carries little risk; a form that collects names and addresses makes you responsible for that data, with legal obligations (in Europe, the GDPR).

3. Running a command without knowing what it does

The AI sometimes suggests commands to type into a terminal. Most are harmless, but some delete files or change your system. Before running a command, ask: "What exactly does this command do, and can it erase anything?" And never run a program found on an unknown page just because it "fixes the problem".

4. Testing with real data

Test with made-up data ("Test Client", "test@example.com"), never with real clients' files or your relatives' details. A coding mistake must not turn into a data leak.