AI Security & Privacy 101

Name: AI Security & Privacy 101
Availability: InStock

NEWIntermediate2h 35mUpdated 2026-05-01

About What you'll learn Curriculum Artifacts Instructor FAQ

About this course

You're already coding with AI. You're already using it at work. This course is the difference between being a smart user and being the breach in next quarter's headlines. 6 modules · 35 lessons · real 2026 incidents · downloadable vendor-diligence checklist + contract clause library + 10 audit prompts you can run on your own codebase tomorrow.

What you'll learn

Spot prompt-injection attack patterns (direct + indirect) and harden against them in code

Build the two-layer rate-limit defense — Vercel Firewall + Supabase credits — that survives serverless cold starts

Run Supabase Security & Performance Advisors before every deploy (the built-in audit most devs miss)

Pick the right HIPAA route — AWS Bedrock + BAA, Anthropic Enterprise, or local (Google MedGemma, Amazon HealthLake AI)

Read SOC 2 / GDPR / WCAG 2.1 AA well enough to demand the right contract clauses

Audit licenses with `npx license-checker --failOn GPL-3.0;AGPL-3.0;SSPL-1.0` before every client delivery

Pen-test your own app WITH AI — Caido, PromptFoo, garak

Course curriculum

6 modules·35 lessons·Total 2h 35m

01The Mexican gov breach — one attacker, Claude Code + GPT-4.1, 195M taxpayer + 220M civil records (Dec 2025–Feb 2026)Preview2m

02The $12M bank loss — procurement shadow agent + indirect prompt injection auto-approved fraud (Q1 2026)Preview2m

03600+ firewalls in 55 countries — fully autonomous AI agent, no human operator2m

04Microsoft Semantic Kernel RCE — CVE-2026-25592 + CVE-2026-26030, prompt injection → host-level code execution (May 2026)2m

05The number: 88% of AI-deploying orgs had a confirmed or suspected security incident this year. Only 6% of security budgets fund AI.2m

01Myths — 'AI is smarter so it's safer', 'we use Claude so we're fine', 'our prompt is locked down'2m

02Direct injection vs indirect injection — the distinction that gets every team2m

03Real attack patterns — web-fetch payload, document poisoning, tool-output exfil, system-prompt extraction2m

04Agent → RCE — the Semantic Kernel pattern and why it generalizes to every agent framework2m

05Defenses Layer 1 — input sanitization + output validation + content filtering2m

06Defenses Layer 2 — tool-call allowlists, model-as-judge for safety checks2m

07Claude Code rules — ALLOWED_TOOLS, deny-by-default, sandbox mode1m

01'Denial of Wallet' — what Kevin called it, what OWASP folded into 'Unbounded Consumption'2m

02The actual cost: one unguarded /api/chat endpoint = unbounded Anthropic/OpenAI bill2m

03Why in-memory rate limiters DO NOT WORK on serverless — Vercel cold starts reset the Map2m

04Two-layer defense — Vercel Firewall (IP rate limit) + Supabase credits table (per-user daily budget)2m

05Monitoring + billing alerts — daily AI-spend checks, anomaly detection1m

01Row-Level Security — locked-by-default vs the demo mode that ships open2m

02The Supabase Advisors trick — Security + Performance, run before every deploy2m

03Service-role key NEVER in client code — how to spot it, how to fix it2m

04API keys — `.env.local` not `.env`, never `git add -A`, rotate when teammates leave2m

05Auth — magic links vs passwords vs SSO. httpOnly / secure / sameSite cookies2m

06Open ports, exposed admin URLs, leaked /api/_internal — the audit checklist2m

01SOC 2 — what it is, when you actually need it, the Vanta/Drata shortcut2m

02GDPR — data subject rights, deletion, sub-processors, the fines that keep landing1m

03HIPAA — PHI, BAAs, the three legal routes (AWS Bedrock+BAA, Anthropic Enterprise, local: Google MedGemma + Amazon HealthLake AI)2m

04ADA Title II Web Accessibility — original April 24, 2026 deadline EXTENDED to April 26, 2027 (state/local ≥50K) and April 26, 2028 (smaller). WCAG 2.1 AA mandatory. HHS May 2026 deadline still live.2m

05OWASP — what it is, why the LLM Top 10 is now mandatory reading2m

06License audit — MIT vs GPL/AGPL/SSPL. `npx license-checker --failOn` before every client delivery1m

01U.S. v. Heppner (Feb 2026, Judge Rakoff SDNY) — Claude chats NOT attorney-client privileged. The training-on-inputs problem2m

02Warner v. Gilbarco (E.D. Mich., Feb 2026) — the counter-ruling. Enterprise AI under counsel direction CAN be work-product protected1m

03The local-model trade-off — privilege/HIPAA win, but no harness like Claude Code. The honest math2m

04Claude with browser + computer access — what you're actually agreeing to. The trust budget2m

05Pen-test your own app WITH AI — Caido, PromptFoo for adversarial testing, garak2m

06Wrap-up: the 10 audit prompts you can run on your codebase tomorrow2m

What you take home

6 downloadable artifacts

Every course ships with the methodology AND the working assets. Drop them straight into your stack — they're AI-feedable, so you can paste them into Claude / Cursor / ChatGPT as a system prompt.

SKILL.md — AI security methodology

SKILL.md

The full prompt-injection + data-leakage + rate-limit defense playbook as an AI-feedable system prompt.

Vendor due-diligence checklist

Checklist

DPA + SOC 2 + GDPR + HIPAA + training-on-your-data — the questions every AI vendor must answer before you sign.

Contract clause library

Library

Pre-written contract clauses for both sides of the table — developer + business buyer.

10 AI audit prompts for your codebase

Prompt

Feed each to Claude / Cursor / ChatGPT to scan your repo for the specific vulnerabilities covered in the course.

API key storage matrix

Cheatsheet

.env.local / Vercel envs / GitHub Secrets / 1Password — what goes where, when, and why.

License audit one-liner

Code

The `npx license-checker --failOn` command to run before every client delivery — catches GPL/AGPL/SSPL.

Meet your instructor

Allen Seavert — in residence

Founder · SetupBots · Phoenix, AZ

13+ years building. Shipped marketplaces, CRMs, lead engines, and content pipelines for clients from solo founders to 8-figure companies. Built a production experiences marketplace from scratch — scraped 13,706 leads with AI, wired a seat-race booking system, and automated cold email at scale. Now teaching the methodology.

13+Years building

5Agent tools supported

100%Of the catalog — free

Frequently asked questions

No. This course is built for non-developers. Foundations like Claude Code, Supabase, Vercel, and GitHub are taught from zero. By the end you'll be shipping real apps without writing code yourself.

Lifetime access. You get every future update to the course as the tools evolve. No expiring subscriptions.

30-day no-questions-asked refund. If the course doesn't deliver on what we promised, we refund and we want to know why so we can improve.

Yes — completion certificates are issued automatically when you finish all course modules. They're shareable on LinkedIn.

Yes. Many operators buy a course first then book a consulting engagement to apply it to their specific business. Email growth@setupbots.com for details.

SUPER/SETUP · FREE IN EARLY ACCESS

The agent brain API.

Plug Claude Code, Codex, Cursor, VS Code, or Antigravity into the SetupBots brain — the methodology your agent reads on every build. Free with your account, like every course here.

29+ courses, growing — all free
Brain API access for your agent
25 hours of audio · drive, walk, lift
Community for you and your agent

Free with your account

No card · generous daily allowance

Free2h 35m · 35 lessons

Welcome to SetupBots

Start here

Featured courses

AI Websites Fundamentals

AI Design Fundamentals

Supabase from Zero

AI SEO — Scale Traditional SEO with AI

AI Search — Get Cited by ChatGPT, Claude, Perplexity

Vercel Deploy & Production

AI Security & Privacy 101

About this course

What you'll learn

Course curriculum

What you take home

SKILL.md — AI security methodology

Vendor due-diligence checklist

Contract clause library

10 AI audit prompts for your codebase

API key storage matrix

License audit one-liner

Meet your instructor

Allen Seavert — in residence

Frequently asked questions

The agent brain API.

AI Security & Privacy 101

About this course

What you'll learn

Course curriculum

What you take home

SKILL.md — AI security methodology

Vendor due-diligence checklist

Contract clause library

10 AI audit prompts for your codebase

API key storage matrix

License audit one-liner

Meet your instructor

Allen Seavert — in residence

Frequently asked questions

AI for Business Owners

Claude Code Fundamentals

Getting Started with AI

AI Search — Get Cited by ChatGPT, Claude, Perplexity

AI Web Design — The Flagship

PostHog Setup (Analytics + Funnels + Replay)

The agent brain API.