Security and compliance
Keep secrets safe, respect consent, and know the rules before a client asks.
List every key and password you use and where each is stored. Move any that are in a file or a chat.
Your learning checklist
0 of 7 steps marked · opening your workspace
Handle secrets properly
Leaked API keys are the most common and most expensive beginner mistake. Keep them out of code and Git, and rotate any that leak.
articleThe Twelve-Factor App: Config
Why configuration and secrets belong in the environment, not in code.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsOWASP Secrets Management Cheat Sheet
Centralizing, auditing and rotating keys, credentials and certificates.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsGitHub secret scanning
GitHub detects exposed credentials so you can rotate them before they are abused.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
repoGitleaks
Open-source scanner that finds secrets in your own repos and history; run it before pushing.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
Give agents and tools least privilege
An agent can only leak or delete what it can reach. Give each tool the smallest permissions and keep each client's credentials separate.
docsClaude Code security
Permission modes, sandboxing, prompt-injection safeguards and advice for untrusted content.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsMCP Security Best Practices: Scope Minimization
Why broad scopes like admin or all-access raise the damage when a token leaks.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
Learn the standard attack lists, including prompt injection
Prompt injection means hidden instructions in content your AI reads. Know the pattern that makes it dangerous: private data plus untrusted input plus a way to send data out.
docsOWASP Top 10 for LLM applications
Ranked risks for AI apps; prompt injection is number one.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsOWASP LLM Prompt Injection Prevention Cheat Sheet
Layered defences, agent tool safeguards and testing methods.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
articleThe lethal trifecta for AI agents (Simon Willison)
A plain rule of thumb: an agent with private data, untrusted content and outside communication can be tricked into leaking.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsOWASP Top 10
The standard list of web application risks.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
Scan your own systems only
These tools are for checking things you own or have written permission to test. Pointing them at anyone else's systems can be illegal and gets IPs blocked.
docsNmap Reference Guide
Network discovery to see which ports your own server exposes.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsZAP: Getting Started
Free web application scanner (now under Checkmarx) to test your own site.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsWazuh: Getting started
Open-source security monitoring platform for your own servers.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
repoTrivy
Finds vulnerabilities, misconfigurations and secrets in containers and code repositories.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
Learn the rules for calls and texts (TCPA and consent)
Unconsented marketing texts and automated calls create lawsuits. Learn the law and your carrier's registration rules before sending anything. The FCC one-to-one consent rule was vacated in 2025 per law-firm summaries, so check current rules with a lawyer.
docs47 U.S. Code 227 (TCPA statute)
The law on autodialers, prerecorded calls and private lawsuits; hard reading but the source.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsFTC: Complying with the Telemarketing Sales Rule
Who must follow the rule, exemptions, disclosures, consent and do-not-call requirements.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsTwilio: Programmable Messaging and A2P 10DLC
US carrier registration for business texting, which is built on verified, consent-based messaging.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsTwilio error 30924: non-compliant consent language
Spells out what opt-in text must say (message type, frequency, rates, how to stop); a practical consent checklist.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
Follow the rules for cold email
Email has its own law (CAN-SPAM) plus mailbox-provider rules that can block you even if you follow the law.
docsFTC: CAN-SPAM Act compliance guide for business
Required disclosures, opt-out duties and penalties for commercial email.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsGmail email sender guidelines
Authentication, spam-rate and volume limits Google applies to senders.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
Privacy law basics and HIPAA awareness
If you touch customer or health data you inherit duties. Learn the vocabulary, then ask a lawyer about your own case; health data needs special care.
docsCalifornia Attorney General: CCPA
Plain FAQ on consumers' rights to access, delete, correct and opt out.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
siteIAPP US State Privacy Legislation Tracker
Maps which states have comprehensive privacy laws and what they require.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsFTC: Privacy and Security business guidance
The FTC's hub on business obligations for personal and health data.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
docsHHS: HIPAA Privacy Rule for professionals
The official summary of who is a covered entity and what the Privacy Rule requires.
- Cost / access
- free · Service usage, hosting, or model access may be separate.
- Setup
- Follow the linked provider’s current instructions; check account and runtime requirements.
You have made a start when…
- No secret lives in code or chat.
- You have a consent record for every person you contact.
- You can answer a client's security questions in writing.
Take this into your assistant.
Additional curriculum comes from the supplied AI Frontiers playbooks. Resource descriptions and cost labels are source guidance, not a fresh verification of pricing, compatibility, or results. Open the official instructions before using a tool. Checklist marks are your own progress notes.