Your AI App is Leaking
A 30-minute hands-on workshop on securing AI-powered applications in production — from API keys in the client bundle to prompt injection that walks straight past your authorization layer. Bring a laptop: you fix three real bugs, red to green.
Every team is shipping AI features. Most are bolting intelligence onto architectures that were never designed to protect the data those models consume. The result is predictable and it is everywhere: API keys in client bundles, unvalidated model inputs, sensitive documents streamed to third-party inference APIs with no access controls, and prompt injection attacks that bypass the entire authorization layer.
This 30-minute workshop at DevFest Abuja 2026 is a hands-on walkthrough of what it actually takes to secure an AI application from code to deployment, built on patterns from production systems rather than theory slides. The slides run side by side with a deliberately vulnerable app and its hardened twin: you clone the repo, watch the same attack succeed and then fail, and make three failing tests go green.
What the workshop covers
Access and agency. Your /api/chat is not a CRUD route — it is a metered, privileged, impersonatable resource. One gateway holds the provider key server-side and owns every control: session JWT verification, rate limits, input caps and an audit log. Tool calls that change state go through a step-up MFA gate, and the approval is a signed, expiring, single-use ticket bound to the user, the action and its exact arguments.
Prompt, stream and pipeline. Treating model inputs with the discipline you would apply to SQL. Structural delimiters are a mitigation, not a fix. Direct injection is the noisy case; indirect injection through a document your user received is the one that gets you. Canary tokens catch a system-prompt leak mid-stream, but only if the check survives chunk boundaries. Model output is untrusted input, and a secret scanner is only trustworthy once it has caught a secret you planted on purpose. Secrets management gets a word too: Bitbid (formerly bsec) is a Rust CLI that shares team secrets recipient-encrypted and injects them into process memory instead of writing .env files.
Infrastructure hardening. A non-root container with a read-only root filesystem, dropped capabilities, no-new-privileges and a noexec /tmp. CI/CD security gates — Gitleaks, Semgrep, Trivy and npm audit — fail the build rather than filing a ticket. Every control is mapped to the OWASP Top 10 for LLM Applications.
The sovereignty question. When on-premise inference makes more sense than renting cloud capacity — regulation (NDPA, POPIA, Kenya's DPA), resilience after the 2024 subsea cable cuts, and FX exposure for teams earning in local currency and paying per token in USD. The pattern that ships is hybrid routing: a small local model tokenises PII on-premise, the cloud model reasons over surrogates only, and the answer is rehydrated at home.
Browser-side envelope encryption with Web Crypto is not part of the 30 minutes. It protects the wire and the middleboxes, but it does not stop the model reading plaintext, so the workshop spends its time on gateways and tokenisation instead.
Three bugs I shipped
The reference implementation for this workshop had three real defects in it. Each one is on a slide, and each one is a live exercise you fix in the room:
- Exercise 03. A step-up MFA gate whose entire authorization check was
ticket.startsWith('MFA_PROOF_')— a string prefix the attacker controls. - Exercise 05. A canary-token killswitch that tested each stream chunk in isolation, so a canary split across chunks (which is every canary, in production) never matched.
- Exercise 08. A secret scanner that reported a clean tree while a fake credential sat in the source tree, because the regex character class stopped at the first hyphen.
They are in the workshop because the fix is more useful than the pretence, and because each generalises: bind approvals to arguments, test detections against streams rather than strings, and prove your scanner catches a secret you planted on purpose.
What you leave with
A mental model for threat assessment in AI applications, a checklist of vulnerabilities to audit in your own stack, and working patterns you can apply on Monday. The first three items on that checklist are free and take about an hour.
The workshop project — a vulnerable and a hardened gateway, an offline mock model (with optional Ollama for local inference), eight red-to-green exercises, Docker and Compose hardening, and a CI security pipeline — is open source and linked above. Every secret in it is fake. Exercises not covered live are in the repo in the same format, to finish at home.