Break Room / Build it yourself
Before you put it on the internet
Frank would like a word
Claude can write the code. It can also leave the front door unlocked and not mention it. Before you share the link, spend an hour on the boring stuff below.
Most of this takes minutes once you know to look. We'll use SideFrog itself as the example, since everything here was checked on this site.
You are now the IT department. Unfortunately, nobody approved the headcount.
Keep secret keys off the page
If your site uses an AI model, a map or a payment service, it has a secret key. Anything in your page's code can be read by anyone who visits, so a key in the page is a public key. Put the call behind a small server function instead, like an AWS Lambda, a Netlify Function or a Cloudflare Worker, and keep the key in that function's settings. SideFrog's Gemini key lives in its Lambda's settings and never reaches the browser.
Keep keys out of GitHub too. GitHub blocks pushes that contain recognized keys to public repositories by default, and it found over a million leaked secrets on public repositories in the first eight weeks of 2024 alone. If a key ever leaks, delete it and make a new one. Hiding the file afterwards doesn't help.
Put a lid on the bill
Set a budget alert the day you open a cloud or AI account, so you get an email before a mistake becomes expensive. If your provider lets you set a hard spending limit, set one. Then limit how often one visitor can use the expensive part: SideFrog allows six checks a minute and forty an hour from the same visitor, which is plenty for people and useless for a script.
Don't trust what people type
Check the length and shape of anything someone types before you use it. If it goes to an AI model, assume someone will try to talk the model into misbehaving. The security group OWASP lists this, called prompt injection, as the top risk for AI apps, and it warns that the hidden instructions you give the model can leak too. Don't put anything in those instructions you'd mind seeing on Reddit, and don't give the model the power to do anything you couldn't undo.
Collect less
Data you never store can't leak, and you never have to protect it. Skip accounts until you need them, don't log what people type, and make sure your privacy promise matches what the code actually does. SideFrog sends ideas to Gemini to write the answer and stores nothing, so that's what the fine print says.
Turn on the free protections
- Two-factor login on GitHub, your host, your registrar and your AI account.
- HTTPS, which most hosts now turn on for you.
- Security headers, a few lines of host settings that tell browsers to refuse common tricks. Ask your AI tool to write them for your host, then test that the site still works.
- Automatic update alerts for the libraries you use, like GitHub's Dependabot.
Keep a way back
Your GitHub history is your backup for the code. If the site stores anything people give you, back that up separately and try restoring it once. Turn on auto-renew for your domain, because losing it is the most common way a small site disappears.
When to get real help
Some things are worth paying a professional for, even on a side project:
- Taking payments. Use a hosted checkout like Stripe's so card numbers never touch your code.
- Health, financial or other sensitive personal information.
- Logins and passwords. Use a sign-in service instead of building your own.
- Anything aimed at kids.
- Real customers depending on it every day.
That's where you stop being cheap. If you want a second pair of eyes before you get there, pick a time with Mark or message him on LinkedIn.
Got an idea? SideFrog gives you a straight verdict, who'd pay, a first test to run and names with an open .com, in about ten seconds.
Check your ideaWant help building it? Mark helps people vibe code their first site with AI. Pick a time with Mark or message him on LinkedIn.
Questions people ask
My site is tiny. Does any of this matter?
The bill doesn't care how small the site is. A leaked AI key or an unlimited endpoint can run up charges in an afternoon, and bots find new sites within days.
How do I know if my key is in my page?
Open your site, right-click and choose View Page Source, then search for the first few characters of your key. If it's there, everyone can see it. Ask your AI tool to move the call into a server function.
Do I need a privacy policy?
If you collect anything about people, including analytics, a short plain-English page saying what you collect and why is the honest minimum. Some laws require more; that's a question for a lawyer if you collect much.
Can I just ask the AI to make it secure?
Ask, but check. Have it walk you through this list item by item for your actual site, and test each change yourself.
Sources
Last checked October 3, 2026.