Best Practices

AI coding tools are powerful, and using them effectively requires understanding some important practical considerations. This lesson covers code ownership, legal implications, security, and skill development when working with AI.

Code Ownership

Who Owns AI-Generated Code?

The legal landscape is evolving rapidly:

U.S. Copyright Office (2025):

• AI-only generated content is NOT copyrightable
• Human-assisted code with significant creative input MAY qualify
• You must document human contributions for copyright claims

Practical Implications:

• Pure AI output has no copyright protection
• Your modifications and creative direction add protectable elements
• Keep records of your prompts and modifications

Training Data Concerns

Some AI tools may use your code for training:

Best Practices:

• Read your tool's privacy policy
• Enable privacy mode for client work
• Use enterprise plans for sensitive projects
• Document AI usage in commercial projects

License Compliance

The Hidden Risk

AI models are trained on open-source code with various licenses. When AI generates code, it may include patterns from licensed sources.

Research Findings:

• 0.88-2.01% of AI-generated code is "strikingly similar" to existing copyrighted work
• AI may strip attribution from open-source code
• License violations can have legal consequences

Types of Open Source Licenses

Mitigation Strategies

1. Use License Scanning Tools:

# FOSSA, Black Duck, or Snyk for production code
npx license-checker --summary

2. Verify Suggested Packages:

# Before installing AI-suggested packages
npm info <package-name> license

3. Document AI Usage:

• Keep records of significant AI contributions
• Note which parts were human-written
• Consider adding AI attribution to commits

Security Responsibilities

AI Code Has More Vulnerabilities

Research from CodeRabbit (2025) found:

Another study found 40-45% of AI-generated code contains vulnerabilities.

High-Risk Areas

Never blindly trust AI for:

• Authentication and authorization
• Password handling and storage
• Encryption and cryptography
• Input validation and sanitization
• SQL query construction
• File system operations
• API key management

Security Review Checklist

## Before Using AI-Generated Code

- [ ] No hardcoded secrets or API keys?
- [ ] Input validation present?
- [ ] Parameterized queries (no SQL injection)?
- [ ] Proper output encoding (no XSS)?
- [ ] Authentication checks in place?
- [ ] Authorization verified?
- [ ] Error messages don't leak sensitive info?
- [ ] Logging doesn't include sensitive data?

Secure Coding Examples

Bad - SQL Injection Risk:

// AI might generate this
const query = `SELECT * FROM users WHERE id = ${userId}`

Good - Parameterized Query:

// Always use parameterized queries
const query = 'SELECT * FROM users WHERE id = $1'
await db.query(query, [userId])

Bad - XSS Risk:

// Dangerous - renders HTML directly
<div dangerouslySetInnerHTML={{ __html: userContent }} />

Good - Safe Rendering:

// React escapes this by default
<div>{userContent}</div>

Building Real Skills

The Skill Erosion Problem

Research shows concerning trends:

Maintaining Your Skills

1. Regular Manual Coding:

• Dedicate time to coding without AI
• Work through algorithm problems manually
• Build small projects from scratch

2. Understand Before Committing:

Before accepting AI code, ask yourself:
- Can I explain what this code does?
- Do I understand why it's structured this way?
- Could I debug this if it breaks?
- Would I have written it similarly?

3. Learn Through AI:

• Use AI as a teaching tool
• Ask for explanations, not just solutions
• Study patterns AI uses repeatedly

4. Review and Refactor:

• Don't accept first suggestions blindly
• Improve AI code after understanding it
• Question unusual approaches

The 70% Problem

AI tools often get you 70% of the way quickly, but:

• The last 30% can take longer than expected
• Edge cases require human attention
• Integration with existing code needs care
• Production readiness requires manual work

Plan for:

• Edge case handling
• Error states and recovery
• Performance optimization
• Security hardening
• Testing and validation
• Documentation

Working with Teams

Communicating About AI Usage

Be Clear About AI Assistance:

• Mention AI assistance in code reviews
• Share effective prompts with teammates
• Document which parts used AI help

Document Appropriately:

# Consider AI attribution in commits
git commit -m "feat(auth): add password reset

Co-authored-by: AI Assistant"

Portfolio and Interview Considerations

• Be prepared to discuss AI involvement in portfolio projects
• Understand code well enough to explain it
• Show you can work without AI assistance
• Demonstrate you enhanced AI output meaningfully

Best Practices Summary

The Developer's AI Checklist

1. Review Everything: Never commit code you don't understand
2. Test Thoroughly: AI code needs the same rigor as human code
3. Secure Manually: Always hand-review security-critical code
4. Maintain Skills: Regular practice without AI assistance
5. Be Clear: Communicate about AI usage appropriately
6. Verify Sources: Check licenses and attributions
7. Document Usage: Keep records for legal protection
8. Stay Updated: Tools and policies change frequently

Daily Workflow Checklist

## Before Starting
- [ ] Privacy mode enabled if needed?
- [ ] Understand project licensing requirements?

## While Coding
- [ ] Reading AI suggestions carefully?
- [ ] Understanding code before accepting?
- [ ] Checking for security issues?

## Before Committing
- [ ] Code tested manually?
- [ ] Security review complete?
- [ ] No secrets or sensitive data?
- [ ] Could explain this in code review?

## Ongoing
- [ ] Regular manual coding practice?
- [ ] Learning from AI patterns?
- [ ] Staying current with tool policies?

Looking Forward

The AI development landscape is evolving rapidly:

• Legal frameworks are being established
• Best practices are still being defined
• Tools are improving safety features
• Organizations are creating AI policies

Stay informed and use AI to augment—not replace—your development skills.

Summary

• Ownership: AI-only code may not be copyrightable; document human contributions
• Licensing: AI can introduce license compliance issues; scan and verify
• Security: AI code has more vulnerabilities; always review security-critical code
• Skills: Maintain manual coding practice; understand before accepting
• Communication: Be clear about AI usage in professional settings

Next Steps

You now have a solid foundation in AI development concepts. Move on to the modules that match your learning path—AI Builders if you're new to coding, or AI Editors if you have development experience.