Unit 9: AI features on websites · Lesson 3 of 3 · 20 min
Project: review the assistant's design
Turn what you found into a short design review the team can act on.
mission
- You are
- The analyst writing up the AI widget review.
- Situation
- You have tested the widget's client code and the assistant's behaviour. Now you turn it into findings and fixes.
- Goal
- Map each problem to the control that fixes it.
- Hand in
- A findings table: problem, risk, fix.
An assistant behind a permission gate
Controls for an AI feature
| Command | What it does |
|---|---|
Server-side calls | The browser talks to your server; your server holds the AI key |
No secrets in the prompt | Keep codes, keys and internal data out of the model's context |
Treat input as untrusted | User text and fetched pages are data, never instructions |
Least privilege tools | Read-only by default; risky actions need a human step |
Output filtering | Check answers before they reach the user or run a tool |
Scope to the user | Tools act only on the signed-in person's own data |
Match findings to controls
From the last two lessons you have four problems: a public API key, personal data sent to a third party, a canary that leaked and tools that fire without approval. Pair each with a control above.
you should see Every problem maps to at least one control, and most to two.
Check the hardened widget
The team shipped a second version. Compare where it sends data.
curl -s http://127.0.0.1:8000/help-v2 | grep -oE '/static/[a-z0-9-]+\.js' /static/assistant-v2.js curl -s http://127.0.0.1:8000/static/assistant-v2.js | grep -E 'fetch|Authorization|email|cart' const res = await fetch("/api/assistant", {
you should see It posts to the shop's own /api/assistant with only the message. No key, no email, no cart.
Confirm the server keeps its own key
curl -s -X POST -H 'Content-Type: application/json' -d '{"message":"how do refunds work"}' http://127.0.0.1:8000/api/assistant | jq .
{
"reply": "Refunds take 5 working days once the item is back with us.",
"model": "helper-small",
"stored": false
}
you should see A reply plus stored: false. The browser never sees a provider key.
defender tip Confirm fixes the same way you found the problems: read the new client code and watch the new requests, do not take the changelog's word for it.
What a defender takes away
- 1Every AI finding should name the control that fixes it.
- 2Moving the call server-side fixes the key leak and the data leak at once.
- 3Retest fixes against the live behaviour, not the release notes.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.