Secure in the AI Era

The basics, and what changes when anyone can build with AI.

Six habits for everyone

1. Long passphrase, password managerA different password for every site. Use a passkey where it's offered.
2. MFA on everything that mattersA stolen password alone stops being enough. Never share a one-time password with anyone.
3. Read links right to leftIn email, SMS, WhatsApp and QR codes. The owner is the part just before the ending: iras.gov.sg is IRAS. iras-gov.online is not.
4. Verify on a second channelFor money or identity requests, even on a video call. Call back on a number you already have.
5. Update, and keep backupsInstall updates promptly. 3-2-1: three copies, on two kinds of storage, one kept off-site.
6. Clicked something? Report it fastDisconnect, change the password from a clean device, tell IT. Speed limits the damage.

Singapore government officials will never, over email, phone or video call: ask you to transfer money, ask for your bank login details, ask you to install apps from unofficial stores, or transfer your call to the Police or other officials.

In doubt, call the ScamShield Helpline: 1799. Or check at scamshield.gov.sg.

Using AI at work

• Use the tools your organisation has approved.
• Treat anything pasted into a public AI tool as shared. No personal or confidential data.
• Check the actual output, not just the logs.
• Test on dummy data, never real data.
• Get a second person to review anything that touches personal data.

Built something with AI? Six questions before you ship

1. Is any password or key visible in the browser?Right-click, Inspect, search for "key".
2. Is your database locked?Supabase RLS or Firebase rules on, no red "Unrestricted".
3. Can you see someone else's data by changing a number in the URL?
4. Does your login actually block, or just hide the button?
5. What packages did the AI add?Are they real, and did you check?
6. Does your AI feature obey a hostile message pasted into it?

AI writes the code. You own the consequences.