Security
Using AI safely: securing your accounts, data, agents, server and apps. Ground rules, a security scan and lessons per situation.
In short
Most AI trouble comes from five places: data leaked through chats, hijacked accounts, agents following instructions hidden in untrusted text, exposed servers and apps without access rules. Ten ground rules cover most of it.
Ten ground rules
Section titled “Ten ground rules”- Passkey or two-factor authentication on every AI account.
- No secrets in chats: no passwords, ID numbers, medical or client data.
- Choose deliberately whether your chats may be used for training.
- Only official apps and extensions. Fake AI apps are a known attack route.
- Text is data, not an instruction. What your agent reads can contain a hidden instruction.
- Approval for irreversible actions: sending, paying, deleting.
- Read a skill or MCP server before installing it.
- Keys belong in a vault, not in code, chats or screenshots. Set a spend cap.
- Don’t expose what doesn’t need exposing: SSH with keys only, dashboards behind a VPN.
- Access rules in your app on every table and every route, and a plan for when it leaks.
Security scan for your AI use
Pick what you do, answer a few questions and see what to fix first.
What do you do with AI? Pick everything that applies.
–Your security score
Free · runs entirely in your browser · nothing is stored or sent
Lessons per situation
Section titled “Lessons per situation”You use chat assistantsWhat you never paste into a chat, and the privacy and account settings per assistant.
You use agentsRecognising the lethal trifecta, prompt injection and malicious skills.
You self-hostHardening your server: SSH, firewall, the Docker trap, updates and backups.
You build apps with AIThe security check for vibe-coded apps, and managing keys safely.
Prefer everything in order? Follow the AI security basics learning path. Practise with the game Spot the hidden instruction.