Contents
Last time, I handed everything to an AI and a blog ended up published on the internet. And at the end of that post I wrote: clicking approve without thinking is scary.
When you work by asking an AI, servers and DNS and other things you don't understand start working, still not understood. It's convenient. Genuinely convenient. And then you come to your senses.
Wait, is this actually safe?
This time I'm not leaving that vague fear alone. Let's break down what exactly is scary. Spoiler: there aren't many places that deserve the fear.
Breaking down what's actually scary
That vague "I'm worried about security" usually splits into five things.
For each one: what happens, and how to prevent it.
1. Account takeover
The most realistic and the most painful. If someone gets into your account on a service like Cloudflare or GitHub, they take the whole site with them.
The prevention hasn't changed in years.
- Don't reuse passwords (this is the big one. One leak anywhere and everything falls)
- Turn on two-factor authentication for anything important
Unglamorous, but that alone stops most takeovers. Put differently: however hard you work on everything else, if the password is "the usual one", it's all wasted.
For anyone going "two-factor what now"
On top of the password, it checks who you are a second time, usually with a code on your phone. Think of it as a second lock. Even if the password leaks, the second check stops it.
Every service has "two-factor authentication", "two-step verification" or "2FA" somewhere in its settings. Turn it on starting with the services that matter most.
2. Leaving a secret key lying around
Use AI or web services long enough and you'll be issued an API key — a secret spare key. Accidentally publishing the file you noted it in, straight to the internet: this is a classic beginner accident. It's taping your house key to the front door before going out.
My rule is simple.
- Secret keys live only in a specific file
- Decide up front that this file is never read by the AI and never goes anywhere public
When I ask an AI to do work, I tell it at the start: don't touch files that contain secrets.
For anyone going "API key what now"
It's a long string that lets something use a service on your behalf. You get issued one when you connect to an AI service, for example.
If someone else sees it, they can use your account. On a pay-per-use service, you find out via the bill. Treat it exactly like a password and you'll be fine.
3. Handing the AI too much
An AI chat will engage with anything, so you're tempted to paste anything. Here's my line.
- Don't paste other people's personal information (names, addresses, contact details)
- Don't paste work secrets
- When unsure, ask who would be harmed if this leaked
Most AI services have a setting for whether your input is used for training, and looking at it once changes how comfortable you feel. Incidentally, this blog's rule about not writing about the inside of client work comes from the same instinct.
4. Attacks on your published site
"Now that my site is public, won't hackers come for it?" Short answer: at the personal-blog stage, you don't need to be very scared.
- This blog doesn't hold anything worth stealing in the first place (no member data, for instance)
- Services like Cloudflare come with a certain amount of attack mitigation built in
The moment to get careful is when you add something that receives data from people: a contact form, a comment section. There's more to think about past that point, and I'll write it properly in the post where I actually add one.
5. Waking up to a bill
More of a money accident than a security one, but it belongs in the same family of fears.
- Have a rough idea of the free tier for each service you use
- While you're only testing, one option is to not register payment details at all
This blog currently runs at zero yen, and I've set it up so I'd notice before that changes. "Without realising" is the scary part, so that's the part to close off.
My own cautious rules
Finally, what I actually do when working with an AI. None of it is impressive. But it removes most of the vague fear.
- Before an operation I don't understand, ask "what does this do?"
- Confirm "can I undo this later?" before touching it
- Never let the AI read files containing secret keys
- Take a breath before irreversible buttons: publish, delete
- Occasionally ask the AI to review: "anything bad here from a security angle?"
Ask an AI for anything and it will try. That is exactly why deciding where to stop is my job. That's my answer for now.
Words that came up
- Two-factor authentication: checking who you are a second time, usually via your phone, on top of the password
- API key: a secret spare key that lets something use a service on your behalf
Both are in Hanageruge's AI glossary, as usual (Japanese only for now).
In short: knowing the fear is what makes you free
Thanks to AI, "can I build it?" is fast becoming a non-question. The dividing line from here is whether you can keep building with peace of mind.
Now that you know the five scary places, you can play with AI more safely than you could yesterday. Let's keep going at a comfortable pace.
Next in this series: the legal side of blogging (copyright, quoting, that area). In preparation.
This series is the record of a web-development beginner building a blog with AI. The security thinking here is general and current as of writing. For how to configure each service, check the latest official documentation.
