Run the pre-flight: secrets, money, data, and the law

Review what the AI built left you with a working build you have read. Before strangers touch it, run a pre-flight through the four things working code can still get wrong: secrets, money, data, and the law.

A working build does not hurt you because the code is bad. It hurts you through an operational gap left open at launch.

Secrets: verify the key never leaves the server

Your first hour with the build already put the key on the server, so this station only verifies. Assistants leak keys in two places. The first is the committed environment file: .env holds the key, but .gitignore never got the line excluding it, so the secret rides into git history and every repository you share. The second is the client-side fetch from the opening scene, fixed by a two-line diff:

- const reply = await fetch(PROVIDER_URL, { headers: { "x-api-key": import.meta.env.VITE_API_KEY } });
+ const reply = await fetch("/api/generate", { method: "POST", body: JSON.stringify({ input }) });

The browser now sends input to your own server route and the server attaches the key, the same route FuelTheFam's fridge photo takes: to our server, which calls the model, so no phone ever holds the credential. To close the station, search the project for strings starting with sk- and for secrets prefixed VITE_ or NEXT_PUBLIC_, and confirm .gitignore lists .env. A key that ever entered a shared repository stays readable in every earlier save point, so revoke it at the provider and issue a fresh one; bots watch public repositories and use found keys within minutes.

Money: the cap that turns a runaway loop into an email

One fridge list costs FuelTheFam a fraction of a cent at mid-tier rates, which sounds safe until something loops. A retry bug calling the model a few times a second, left overnight, makes a few hundred thousand calls, and a fraction of a cent multiplied that many times is a bill in the hundreds of dollars by morning. The spend cap from your first hour is the defense; this station arms it on both sides:

• The alert at an amount that would annoy you, so unusual spending reaches you early.
• The hard cap at an amount that would hurt, where the provider stops serving requests whether or not you are awake.

With both set, the runaway night ends in an email saying the cap was reached, not an invoice. Add a daily per-user ceiling on every metered feature so one account or one bug cannot spend the whole cap alone.

The obvious objection is that you reviewed this code line by line, so checking again feels like distrusting your own review. But the pre-flight checks what holds when something outside the review goes wrong, and instructions hold nothing: in July 2025 a coding agent at Replit deleted a live production database during an explicit code freeze, against instructions on record.

The pre-flight verifies enforcement, not intention: a cap, an ignored file, and a revoked key hold at 2 a.m. no matter what the instructions say.

Data: store the minimum and say where it travels

The model layer moves data in a way the rest of your stack does not.

Everything you place in the model's context travels to the provider on every call: the photo, the pasted paragraph, and the user's question all leave your server the moment the feature runs.

The provider's data terms govern what happens after that; your side is the inventory question from Data, where information lives. List every piece of personal data your build touches, write one location beside each, which table, which log, which third-party service, and strike anything without a clear job. Error trackers keep whatever passes through them, so check the logs for emails you never decided to store.

The station ends at the one sentence your privacy page must say. For our fridge list, it reads:

Photos you upload are sent to our AI provider to create your shopping list, are not used to train the provider's models, and are deleted from our servers after 30 days.

Every clause is a claim someone can check. "Sent to our AI provider" is the travel fact above. "To create your shopping list" is the only purpose; if photos also tune your prompts or feed your demos, the sentence says so or it lies. "Not used to train the provider's models" describes someone else's conduct; it appears only after you read the provider's data-use terms for API traffic, and note the date you checked. "Deleted after 30 days" is a number you chose plus a deletion job that runs; the template phrase "as long as necessary" promises nothing, and regulators know it.

The law: the documents a first ship needs

Around that sentence, a first ship needs three documents, each a page or less.

• The privacy page. The retention sentence is its heart; around it go what you collect, where each piece sits, and a working email for deletion requests. A manual process is fine at your scale; anyone whose email you store can ask what you hold and have it erased, whether or not the page says so.
• The terms. What the user may do and what you do not promise: generated output can be wrong, and the terms say so before anyone relies on one. Refund language joins the day you charge money.
• The AI disclosure. A visible line near the input saying the replies are generated. This one carries a date: Article 50 of the EU AI Act, the duty to tell people they are interacting with an AI system, applies from August 2, 2026; the 2026 Digital Omnibus moved other AI Act obligations, not this one. FuelTheFam's shopping list reaches a user with nobody on our team reading it first; that person is owed the fact that a model produced it.

Write the guardrails into the Model Spec

The pre-flight's decisions belong in the Model Spec you have been filling across this part, in its guardrail fields:

• The cap: the number now set at your provider, recorded so it reads as a decision, not an accident.
• The fallback: what the user sees when a call fails or the cap is reached; the fridge feature asks for a retake when a photo is unreadable instead of guessing.
• The never-list: outputs that must never appear; ours includes a confident nutrition estimate from an unreadable plate photo, because a confidently wrong number tells a parent an underfed kid is fine.

Try it now

The full pre-flight takes about 40 minutes and spends nothing. You arrive with the working, reviewed build from Review what the AI built; you leave with all four stations green or fixed and the Model Spec's guardrail fields filled, cap, fallback, and never-list; the next chapter signs them.

No setup: Run the secrets station against an AI product you use: open DevTools on the Network tab, use the AI feature once, and read where the request goes. A route on the product's own domain means the key stayed server-side; a call straight to a provider's API with a key in the headers is the leak from our diff. Then check its privacy page against the dissection above and note what it leaves unsaid.

With your tools: Open Claude Code in your project and start with: "Search this project and its git history for anything that looks like an API key, confirm .gitignore lists .env, and flag any secret prefixed VITE_ or NEXT_PUBLIC_." Fix what it finds, set the alert and hard cap on the billing page yourself, then ask for the inventory: every piece of personal data and where each sits. Draft your retention sentence from the real facts and write the cap, fallback, and never-list into your Model Spec; if a fix touched code, rerun your Proof Table's five inputs. Same moves in Codex or Cursor, from the sidebar chat. If nothing is installed yet, the Setup Clinic gets you running in one sitting.

Chapter Summary

• The pre-flight runs on your real build, after the wiring, and inspects the four things working code can still get wrong: secrets, money, data, and the law.
• Keys leak in two places: an environment file git was never told to ignore, and a client-side call where a VITE_ or NEXT_PUBLIC_ prefix compiles the key into JavaScript every visitor downloads.
• A key that ever entered a shared repository is leaked even after you delete it; revoke it at the provider and issue a fresh one.
• Set the billing alert at an amount that would annoy you and the hard cap at an amount that would hurt; the cap ends a runaway loop with an email instead of an invoice.
• Written instructions are not enforcement; caps, ignored files, and revoked keys hold no matter what goes wrong or who caused it.
• Everything placed in the model's context travels to the provider on every call, so store the minimum and keep a location written beside every piece of personal data.
• Your privacy page's retention sentence is checkable clause by clause: where data goes, for what purpose, whether it trains models, and when it is deleted.
• A first ship carries three documents: a privacy page, terms that admit generated output can be wrong, and a visible AI disclosure, which the EU AI Act's Article 50 requires from August 2, 2026.
• Your Model Spec's guardrail fields now hold the cap, the fallback, and the never-list; take them to Write your Build Plan and ship, where the spec gets signed.

Sources

• Business Insider and Fortune reporting on the Replit coding agent deleting a live production database (July 2025).
• EU AI Act, Article 50 transparency obligations, applicable from August 2, 2026; European Commission Digital Omnibus package (2026), which adjusted other AI Act timelines but not Article 50.
• Anthropic and OpenAI API data-use and retention documentation (last verified July 2026).
• Vite and Next.js documentation on environment variables exposed to client code via the VITE_ and NEXT_PUBLIC_ prefixes (last verified July 2026).
• GitGuardian, The State of Secrets Sprawl, on leaked credentials found and used in public repositories.