🤖 AI & IT Training
Vibe Coding Security — Safety Check for Your AI-Built Web App
Your AI-built web app runs fine, but is it locked down? Break into and secure a deliberately open sample app, and in 4 hours leave with a security score and action list for your own app
⏱ Training hours4 hours
🏢 FormatOn-site delivery · Customized design
👤 InstructorJohn Kim
✅ Key outcomeYou drop the assumption that 'no one knows the address, so it's fine' — and build basic locking habits suited to an era when attackers use AI to scan automatically
A fast-growing number of people use AI coding tools such as Claude Code to connect PC, NAS, and cloud folders and build business web apps. The problem is that confidential material such as quotes, customer lists, and contracts sits directly behind those apps. Overseas, incidents have been reported one after another in which AI-built apps shipped authentication keys inside front-end code, or were deployed without database access rules turned on, exposing customer data wholesale. These are not new hacking techniques; they are old mistakes repeated at scale by people who never learned to code. This course is the next step for professionals who have already built web apps with AI. It draws on the instructor’s own experience running several web apps: an API key exposure that led to unexpected charges, abnormal access attempts, and how regular in-house security checks fixed them. We divide risk into “three doors” — the folders AI reads, the back door of the app you built, and billing — then participants break into a sample app deliberately left open for training, and lock it down. Finally, you score your own app with a 30-item self-check sheet. After the training, each participant leaves with a risk map of their setup, fixed connection settings, a security score and action list for their app, and a one-page incident response sequence. (Four 50-minute modules, including three breaks, 4 hours total)
💻 Start learning this topic with an online course →Who is this course for?
This course is for non-developer professionals in planning, sales, marketing, and administration who have built and deployed a web app or automation at least once with an AI coding tool such as Claude Code; AI champions, innovation leads, and information security officers responsible for the safety of AI web apps their employees build; and owners of one-person or small businesses. If you have never built anything, we recommend taking “Vibe Coding Basics — Build a Website with AI, No Coding” first.
What will you learn?
- Explain how incidents happen in AI-built web apps through “three doors” (folders AI reads, the app’s back door, and billing), and draw a risk map of your own setup
- Narrow the folders an AI coding tool can read to the project level, and separate confidential folders with read-only accounts and block lists
- Understand how instructions hidden in documents and web pages can steer an AI (prompt injection), and apply the principle that what AI reads is 'data, not commands' to how you work
- Find and break into keys exposed in front-end code and disabled database access rules in a sample app, then lock them down by rotating keys, setting rules, and capping spending
- Score your own app with a 30-question self-check, set remediation priorities, and sum up the incident response sequence (revoke → reissue → review logs → notify) on a single page
Curriculum
Module 1: How Incidents Happen — Real Cases and the Three Doors (50 min)
- Reading 5 real incidents — keys exposed in front-end code, access rules left switched off, missing permissions that let others read your projects, key theft via a malicious repository, and vulnerable connector tools
- Instructor case studies: the day an exposed API key ran up a bill of several hundred thousand won, and the day an abnormal access attempt was spotted on a live app
- Translating incidents into money and time — charges, recovery time, customer notification, and the cost of lost trust
- The three doors — 1) the folders AI reads, 2) the back door of the app you built, 3) billing
- Hands-on: Draw a one-page risk map of your setup — which folders connect to which apps, with which keys
Module 2: The First Door — Folders AI Reads (50 min)
- The difference between opening your entire home folder and opening only the project folder — the principle of least privilege
- Demo: how an instruction hidden in a document steers an AI into reading other files (prompt injection)
- Principles for connecting NAS and cloud drives — read-only accounts, separating confidential folders, and splitting read from write
- Criteria for AI coding tool permission settings, block lists, and choosing connected tools (MCP) — never attach a connected tool from an unknown source
- Exercise: fix one gap in the AI working-folder scope and blocklist on your own PC
Module 3: The Second Door — The Back Door and Billing of Your App (50 min)
- Exercise 1, find the key: use your browser’s developer tools to find an exposed key in the front-end code of a sample training app
- Hands-on 2: Break the Rules — see for yourself how someone else’s data can be read from a database with access rules turned off
- Lock it down: move keys to the server side, set access rules to “deny by default,” then retry the same attack to confirm it’s blocked
- Door 3: Billing — separate keys per project, monthly spending caps, unusual-usage alerts, and regular rotation
- Prompts that ask AI to run a security check — “Find everything in this app that can be read without logging in”
Module 4: Run the Check and Prepare for Incidents (50 min)
- Score your app with a 30-item self-check sheet — six areas: folders, keys, access rules, billing, logging, and response
- How to read your score and set priorities — what to fix today, what to fix this week, and what to leave for the quarterly review
- One-page incident response sequence — revoke key → reissue → review usage logs → assess scope of damage → notify
- If personal data was involved — safeguard obligations under the Personal Information Protection Act and the 72-hour breach notification and reporting procedure
- Making it routine — a quarterly review loop that re-scores your apps with the same checklist, plus Q&A
Tools used in this course
Expected results / After the course
- The assumption that “nobody knows this address, so it’s fine” goes away — you build basic locking habits suited to an era when attackers also scan automatically with AI
- Prevent a single exposed key from turning into hundreds of thousands of won in charges — key separation, spending caps, and unusual-usage alerts stay in place as settings
- Confidential files and AI working folders are kept separate — a one-page map shows which tool can read which folder
- Security stops being a one-time check and becomes a regular one — re-measure every quarter against the same standard with a self-check sheet and score
About the instructor
John KimInstructor John Kim, author of “B2B Marketing Design” and CEO of Nanum ConsultingView profile →
Related courses
Recommended online courses
Start with an Online Course
Before you book on-site training, preview the essentials of this topic in an online course.
AI · Online Courses
Claude Cowork · Hands-On Basics
An introductory hands-on course for building work tools that run on plain conversational instructions.
KRW 59,000 (≈ US$44)89,000View Course →
AI · Online Courses
Practical AI for Corporate Instructors
Use AI in your daily work, from lesson prep to content creation.
KRW 59,000 (≈ US$44)89,000View Course →
We tailor this course to your company
From diagnosis to execution — Nanum Consulting
FAQ
This course is for non-developer professionals in planning, sales, marketing, and administration who have built and deployed a web app or automation at least once with an AI coding tool such as Claude Code; AI champions, innovation leads, and information security officers responsible for the safety of AI web apps their employees build; and owners of one-person or small businesses. If you have never built anything, we recommend taking “Vibe Coding Basics — Build a Website with AI, No Coding” first.
Yes. Instead of security jargon, we use a simple map called the “three doors,” and the hands-on work needs only a browser and an AI coding tool. You should, however, have built an app with AI at least once so you can keep up with the Module 3 exercise.
No. We only use sample apps deliberately made vulnerable for training. We never touch anyone else’s services or your company’s production systems, and in the first session we make clear that testing systems without permission is illegal.
You will need a personal laptop, the Chrome browser, and an account for the AI coding tool you normally use (a paid Claude account is recommended). If you have built a web app, bring its address and make sure you can access its settings screen, so we can score it right away in Module 4. We will send these instructions again in a pre-training guide.
This course covers the basics of finding and locking the most common incident paths yourself; it does not replace a professional security assessment or penetration test. If your service handles customer personal data or payments, we recommend a separate professional assessment after the training. What you will know by the end is where you are open and what to fix first, in the form of a score and a list.
Other courses teach how to 'build' with AI; this one covers how to 'protect' what you built. We add no new features. All 4 hours go to checking the apps you have already made, plus the folders, keys, and access rules connected to them. It works well as a follow-up for organizations that have completed vibe coding training.
Vibe Coding Security — Safety Check for Your AI-Built Web App
Your AI-built web app runs fine, but is it locked down? Break into and secure a deliberately open sample app, and in 4 hours leave with a security score and action list for your own app
Training objectives
- Explain how incidents happen in AI-built web apps through “three doors” (folders AI reads, the app’s back door, and billing), and draw a risk map of your own setup
- Narrow the folders an AI coding tool can read to the project level, and separate confidential folders with read-only accounts and block lists
- Understand how instructions hidden in documents and web pages can steer an AI (prompt injection), and apply the principle that what AI reads is 'data, not commands' to how you work
- Find and break into keys exposed in front-end code and disabled database access rules in a sample app, then lock them down by rotating keys, setting rules, and capping spending
- Score your own app with a 30-question self-check, set remediation priorities, and sum up the incident response sequence (revoke → reissue → review logs → notify) on a single page
Expected results
- The assumption that “nobody knows this address, so it’s fine” goes away — you build basic locking habits suited to an era when attackers also scan automatically with AI
- Prevent a single exposed key from turning into hundreds of thousands of won in charges — key separation, spending caps, and unusual-usage alerts stay in place as settings
- Confidential files and AI working folders are kept separate — a one-page map shows which tool can read which folder
- Security stops being a one-time check and becomes a regular one — re-measure every quarter against the same standard with a self-check sheet and score
Curriculum
Module 1Module 1: How Incidents Happen — Real Cases and the Three Doors (50 min)
- Reading 5 real incidents — keys exposed in front-end code, access rules left switched off, missing permissions that let others read your projects, key theft via a malicious repository, and vulnerable connector tools
- Instructor case studies: the day an exposed API key ran up a bill of several hundred thousand won, and the day an abnormal access attempt was spotted on a live app
- Translating incidents into money and time — charges, recovery time, customer notification, and the cost of lost trust
- The three doors — 1) the folders AI reads, 2) the back door of the app you built, 3) billing
- Hands-on: Draw a one-page risk map of your setup — which folders connect to which apps, with which keys
Module 2Module 2: The First Door — Folders AI Reads (50 min)
- The difference between opening your entire home folder and opening only the project folder — the principle of least privilege
- Demo: how an instruction hidden in a document steers an AI into reading other files (prompt injection)
- Principles for connecting NAS and cloud drives — read-only accounts, separating confidential folders, and splitting read from write
- Criteria for AI coding tool permission settings, block lists, and choosing connected tools (MCP) — never attach a connected tool from an unknown source
- Exercise: fix one gap in the AI working-folder scope and blocklist on your own PC
Module 3Module 3: The Second Door — The Back Door and Billing of Your App (50 min)
- Exercise 1, find the key: use your browser’s developer tools to find an exposed key in the front-end code of a sample training app
- Hands-on 2: Break the Rules — see for yourself how someone else’s data can be read from a database with access rules turned off
- Lock it down: move keys to the server side, set access rules to “deny by default,” then retry the same attack to confirm it’s blocked
- Door 3: Billing — separate keys per project, monthly spending caps, unusual-usage alerts, and regular rotation
- Prompts that ask AI to run a security check — “Find everything in this app that can be read without logging in”
Module 4Module 4: Run the Check and Prepare for Incidents (50 min)
- Score your app with a 30-item self-check sheet — six areas: folders, keys, access rules, billing, logging, and response
- How to read your score and set priorities — what to fix today, what to fix this week, and what to leave for the quarterly review
- One-page incident response sequence — revoke key → reissue → review usage logs → assess scope of damage → notify
- If personal data was involved — safeguard obligations under the Personal Information Protection Act and the 72-hour breach notification and reporting procedure
- Making it routine — a quarterly review loop that re-scores your apps with the same checklist, plus Q&A
About the instructor
John Kim, Lead Instructor
10 years in industry · 15 years teaching (3,000+ lectures)
Education
· MBA (advanced major: Marketing), Korea University Graduate School of Business (graduated)
· Sungkyunkwan University Consultant Program (completed)
· Sogang University Graduate School of Business, Short-Term MBA (completed)
· Seoul National University Lifelong Education Instructor Development Program (completed)
· Chung-Ang University, B.A. in English Language and Literature (graduated)
Experience
· Current: CEO, Nanum Consulting
· Formerly at Hyosung Corp., Daeduck Electronics and Shinhan Diamond: overseas assignments and strategic planning (10+ years)
· Current partner instructor, Expert Consulting
· Current: Partner instructor, PSI Consulting
· (Current) Partner instructor, Korea SMEs and Startups Agency and SME Training Institute
Credentials and publications
· Certified consultant
· Certified teacher
· Completed official IDEO Design Thinking training
· B2B Marketing Design (1 Apr 2025)
· The Chinese Diamond Tool Market: Present and Future (co-authored, Korea Tool Association)
· Battles That Changed History and Innovative Weapons (in progress)