Secure vibe coding for beginners: keep your API keys and data safe

Short answer: never paste API keys or passwords into an AI chat, keep secrets in a .env file that's listed in .gitignore (and in your host's environment-variable settings when you deploy), review every change the AI makes, make a git save point after each working step, and run a secrets check before your app goes live. Exposed API keys are among the most common problems found in AI-built apps, so these habits matter.

The 6 safe habits

1. Never paste secrets into AI chats. Use a placeholder like YOUR_API_KEY instead. The AI doesn't need the real value to write the code.
2. Secrets live in .env, never in code. Add .env to .gitignore before your first commit. When you deploy, put the keys in your host's environment variables dashboard.
3. Secret keys stay on the server. Anything sent to the browser can be read by anyone. Keys like sk_live_… or a Supabase service_role key must never be in front-end code.
4. Review AI changes before accepting them. Use your tool's approval or manual mode, and ask "explain this change like I'm new" whenever you're unsure.
5. Make save points with git. One commit per working step means you can always roll back.
6. Check before you go live. Run the prompt below, plus the full secrets safety check.

Prompt: set up secrets safely from the start

I'm a beginner. Before we write any features, please set up this project safely:
1. Create a .gitignore that includes .env and any other secret or local files.
2. Create a .env.example with placeholder names only (no real values).
3. Show me how the code should read keys from environment variables.
4. Tell me which keys must stay on the server and never reach the browser.
Never ask me to paste a real key into this chat.

Prompt: pre-launch security check

Please do a beginner-friendly security review of this whole project before I put it online:
- Search for any API keys, passwords or tokens written directly in the code or committed to git history.
- Check that no secret keys are used in front-end/browser code.
- Check that .env is in .gitignore.
- Check that user input is validated and that any database has access rules (like row level security) turned on.
List problems from most to least serious, explain each in plain English, and fix them one at a time.

If a key leaks

Don't panic. Revoke or rotate the key in the provider's dashboard right away (deleting it from the code isn't enough, because it may still be in git history), then update your .env and your host's settings.

SI's chill tips

• Using AI tools with MCP servers or plugins? Only install ones you trust, give them the smallest access they need, and keep approval prompts on.
• Add these rules to your AGENTS.md so your AI follows them automatically.
• Safe is a habit, not a hassle. You've got this.