AI Coding Tools - lesson 3 | HackIndia Skills

AI Coding Tools - lesson 3 | HackIndia Skills | HackIndia

Example

Safe env setup

Commit the example file. Do not commit the real one. Your README can tell judges to copy .env.example to .env and add their own values.

# .gitignore
.env
.env.local
*.pem
service-account.json

# .env.example
MONGODB_URI="your_mongodb_connection_string"
RAZORPAY_KEY_ID="your_razorpay_key_id"
RAZORPAY_KEY_SECRET="your_razorpay_key_secret"
JWT_SECRET="change_this_for_local_dev"

Example

Read, do not hardcode

This pattern keeps secrets outside code. If an AI assistant suggests hardcoding a key, reject that part and ask for environment-variable based code.

// Node.js example
const express = require("express");
require("dotenv").config();

const app = express();

const mongoUri = process.env.MONGODB_URI;
if (!mongoUri) {
  throw new Error("Missing MONGODB_URI in environment variables");
}

// Use mongoUri to connect. Do not paste the real URI here.

Common mistake

Bad AI prompt

Do not paste a real .env file into ChatGPT, Gemini, Claude, Copilot Chat, or any shared chat. OpenAI also warns not to include passwords, financial details, account numbers, or other sensitive personal information in shared content.

Ask the assistant to review filenames and patterns instead. If you use ChatGPT, Temporary Chat does not show in history and is not used to train models, but you should still avoid entering secrets.

Bad:
Here is my .env. Fix my Razorpay integration: RAZORPAY_KEY_SECRET=rzp_secret_real_value

Better:
Review this code for hardcoded secrets. Do not ask me to paste secret values. Check for env variable usage and missing .gitignore entries.

Keep Secrets Out

One rule

What counts

Store them safely

Safe env setup

Read, do not hardcode

Bad AI prompt

Use AI safely

Do this now

Quick check