Keeping it safe · for software engineers
Using AI safely in software engineering
Engineers handle source code, credentials, production data, and security details every day. Much of that should never go into a tool your company has not approved for it. A pasted API key or a production database dump in a prompt can expose customers and break agreements.
Keeping it safe also covers what comes back. Generated code can include insecure patterns, outdated dependencies with known vulnerabilities, or text close to licensed code. The engineer who commits it is responsible for it.
Where it comes up
Debugging with a configuration file
Before pasting a config file or an environment dump, remove keys, tokens, passwords, and connection strings. Replace them with placeholders that keep the structure readable.
Investigating a production data bug
Reproduce the problem with synthetic or masked records. Use real customer data only in a tool your company has approved for it, and only the fields you need.
Accepting a large generated block
Check whether the code resembles a known open-source project. Confirm that its license is compatible with yours and that any attribution it requires is in place.
What it looks like at each band
E1 · Foundational
Knows that secrets and customer data should not go into AI tools, but does not always notice them in a log file or a stack trace. Follows the company’s AI policy when reminded of it.
E2 · Proficient
Removes secrets and personal data before sharing code or logs as a habit. Uses only approved tools for proprietary code. Reviews generated code for common security problems, such as injection and unsafe input handling.
E3 · Distinguished
Judges risk across a whole change, including data exposure, dependency vulnerabilities, licensing, and permissions given to AI agents. Raises concerns early in design review. Knows when a task should not use AI at all, such as handling unreleased security fixes.
E4 · Exceptional
Shapes the team’s practice: which tools may see which code, what access agents get, how generated code is scanned, and how licensing questions are handled. Responds to a mistake openly and fixes the process that allowed it.
Common mistakes
Pasting a stack trace with secrets in it
Error output can include connection strings, tokens, and request headers. Read the trace before you paste it and replace any credential with a placeholder.
Giving an agent broad access
An agent with production credentials or write access to every repository can do damage from one wrong step. Grant the least access the task needs and review its actions.
Ignoring the license of generated code
Generated code can closely match code under a license your project cannot accept. Check large or distinctive blocks before you commit them, and follow your company’s policy.
A worked example
Finding out why a background job fails for some customers, using its error logs.
Copy the last day of raw job logs, including customer emails and an API token in a request header, into a personal AI account and ask what is wrong.
A live credential and customer personal data are now in a tool the company has not approved. The token must be rotated, and the exposure may need to be reported under the company’s data policy.
Filter the logs to the failing job runs. Replace emails with customer IDs and remove the token and other headers. Confirm nothing sensitive remains. Use the company’s approved AI tool, and ask for likely causes with the log lines that support each one. Check the leading cause against the job code before you change anything.
The investigation still happens. Secrets and personal data stay out of the prompt, the tool is approved, and the diagnosis is checked against the code.
The full study guide for this skill, for every role, is Keeping it safe. The other five skills for software engineers are on the AI skills for software engineers page. A one-page summary is in the AI data safety checklist.
See where you stand
The free check grades keeping it safe and the other five skills in about fifteen minutes. Nobody sees the grade but you.
Then build the skills and prove it. The three steps for software engineers list the courses and templates that fit the work.