programming · Level 2

Build your first app with an AI coding assistant

Brief it, build in small steps, read the code, test the awkward cases and keep control, using a bill splitter as the running project.

By Mickarle Wagstaff-Irons - Micky Irons

Level 2Getting going
120 min
5 chapters
Online course and PDF workbook

Start course online Download free PDF (PDF, 2.0 MB)

The Sequenceprogramming / 02

Your next step

Start this course online

Register your start, then work through the lessons and exercises at your own pace. You can download the PDF separately. Where a scored exam is available, you will find it after the lessons.

Your name

Your email

Mickai privately records this registration and sends its team a course-start notification. It records your intention to start, not proof of attendance or completion. Our course-start privacy notice explains the details and the 30-day resume cookie.

Follow the Mickai company page on LinkedIn

You can start learning without subscribing or following. Newsletter email confirmation and provider enrolment are recorded separately.

Start with the essentials

The short answer

An AI coding assistant writes code by predicting text that looks likely to fit, so its code can look tidy and still be wrong. Stay in control: write a short brief with worked examples first, build in small steps, save a copy before each change, read the code against a checklist, test the awkward cases yourself, and never share secrets or personal data.

What you will learn

You will be able to write a one-paragraph brief with worked examples before you ask an assistant for code.
You will be able to build a small web page in short steps with any kind of assistant, keeping a working copy at each stage.
You will be able to review code against a checklist: what it reads, changes, sends and stores, and how it handles bad input.
You will be able to test with examples first and edge cases second, and to explain why an assistant's own explanation is not proof.
You will know how to work safely: no secrets or personal data, a scratch folder for agents, permission prompts read, dry runs first.
You will know what to check about a tool's terms and a code licence, and when to stop and learn the language properly.

Who it is for

Beginners who have never built an app and want to use an AI assistant to make a small one while understanding it and staying in control. You need a computer with a web browser and a plain text editor. No programming experience is needed.

Before you start

Comfort asking an AI assistant for things in plain words, as in the Your first prompts workbook. You need a computer, a web browser and a plain text editor. An assistant is helpful but not required: the exercises use the example code in this workbook.

Learn in your browser · Chapter 01 of 05

What an assistant is, and how to brief one

An assistant writes code in seconds. Checking it is your job, and a clear brief helps.

An AI coding assistant writes, edits and explains code from a plain-words request. It predicts likely text, so its code can look tidy and still be wrong. OWASP's AI risk guidance says models can give answers that sound correct but are unfounded, and suggest insecure or non-existent libraries.

There are three rough kinds. Products blend them and change often, so this workbook names none; every step suits all three.

Scroll sideways to see every column.

What an assistant is, and how to brief one · Table 1
Kind	How you use it	What it can touch
Chat assistant	It replies with code and you copy it into a file.	Only what you paste in.
Editor assistant	It suggests or edits code inside your editor.	Files open in that editor.
Agent	It edits files and runs commands to reach a goal.	Files and programs, within your permissions.

The running project is a bill splitter: one file, index.html, run in your browser. Enter a bill, a tip percentage and a number of people, and it shows what each person pays, to the penny. Money is a fair test: rounding must be exact.

Write a brief first: a paragraph on what the program is for, what goes in, what comes out and what it must never do, plus examples worked out by hand. They remove ambiguity and become your first tests. Whatever you leave out, the assistant decides.

text · 10 lines

Build a bill splitter as ONE file, index.html: HTML, CSS and JavaScript inline, no libraries, no external requests, nothing saved or sent.
Inputs: bill in pounds, tip in per cent, number of people.
Output: tip, total and what each person pays, to the penny. Shares must add up exactly to the total: when pennies cannot be split equally, some people pay one penny more.
Refuse empty, negative, zero-people or absurdly large input, with a clear message.
Comment the code in plain English.

Examples, worked by hand:
90.00, tip 10, 4 people: tip 9.00, total 99.00, each pays 24.75.
100.00, tip 0, 3 people: total 100.00, shares 33.34, 33.33, 33.33.
90.00, tip 10, 0 people: refuse (no dividing by zero).

Try it yourself · Activity 01

15 min

Write a brief before you ask

You want a page showing a price after a percentage discount. Without asking an assistant, write a one-paragraph brief and five worked examples.

Write the brief: format, inputs, outputs, rounding rule, what it must never do, bad input.
Write five examples worked by hand: two ordinary, one needing penny rounding, one at a limit, one to refuse.

What would an assistant have had to guess?

Worked answer

Model brief: one file, discount.html, inline HTML, CSS and JavaScript, no libraries, no network, nothing stored. Input: a price in pounds, two decimals at most, and a whole discount from 0 to 100 per cent. Output: discount and new price to the penny, halves up. Refuse bad input with a message. Model examples: 80.00 at 25% gives 60.00. 19.99 at 15%: discount 2.9985 rounds to 3.00, price 16.99. 0.99 at 50%: 0.495 rounds up to 0.50, price 0.49. 10.00 at 100%: 0.00. 10.00 at 101%: refused. Yours will differ; check it fixes rounding and refusals.

Next chapter

Learn in your browser · Chapter 02 of 05

Build in small steps, and keep a working copy

Ask for one small piece, check it, save a copy, then ask for the next.

Keep a working copy. Work in a folder called bill-splitter. Before each change, copy the working file as index-copy-01.html, then index-copy-02.html. If a change breaks the page, go back to the last good copy. Never let an assistant edit your only copy.

Use these four prompts in order: small steps give code you can check. After each, open index.html in your browser (double-click it or drag it into a browser window), try your examples and save a copy.

text · 4 lines

Step 1, the page. From my brief, write index.html with the three inputs and an empty results area. No calculations yet.
Step 2, the sums. Add splitBill in whole pence, never fractions. Round the tip to the nearest penny, halves up. Shares must add up exactly. Show the arithmetic for my examples.
Step 3, bad input. Refuse empty, negative, zero-people, non-numeric or absurdly large input, and bills with more than two decimals, each with a clear message.
Step 4, the check. Add a button that runs my examples and the bad-input cases and prints PASS or FAIL for each. I will supply the expected answers.

Copying code out of a PDF can add a line break wherever a line wraps, and one stray break inside a string can stop the whole page. The web page for this workbook shows this chapter's code with a Copy code button that copies it exactly. If you would rather use the PDF, type the code in by hand or check every line after pasting.

html · 107 lines

<!doctype html>
<html lang="en-GB">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Bill splitter</title>
<style>
  body { font-family: system-ui, sans-serif; max-width: 26rem; margin: 2rem auto; padding: 0 1rem; }
  label { display: block; margin-top: 1rem; }
  input { font-size: 1rem; width: 100%; box-sizing: border-box; }
  #error { color: #a00000; }
  #result, #checks { white-space: pre-line; }
</style>
</head>
<body>
<h1>Bill splitter</h1>
<label>Bill in pounds <input id="bill" inputmode="decimal" value="90.00"></label>
<label>Tip in per cent <input id="tip" inputmode="decimal" value="10"></label>
<label>Number of people <input id="people" inputmode="numeric" value="4"></label>
<p id="error" role="alert"></p>
<p id="result" aria-live="polite"></p>
<button id="check" type="button">Run self-check</button>
<p id="checks"></p>
<script>
"use strict";

const MAX_PENCE = 100000000; // 1,000,000.00 pounds
const gbp = new Intl.NumberFormat("en-GB", { style: "currency", currency: "GBP" });
const money = (pence) => gbp.format(pence / 100);
const el = (id) => document.getElementById(id);

// "45.60" becomes whole pence (4560). Anything that is not a plain amount gives null.
function toPence(text) {
  const m = /^(\d+)(?:\.(\d{1,2}))?$/.exec(String(text).trim());
  return m ? Number(m[1]) * 100 + Number((m[2] || "").padEnd(2, "0")) : null;
}

// "12.5" becomes tenths of a per cent (125). Anything else gives null.
function toTenths(text) {
  const m = /^(\d+)(?:\.(\d))?$/.exec(String(text).trim());
  return m ? Number(m[1]) * 10 + Number(m[2] || 0) : null;
}

// Works only in whole pence, so no fraction of a penny ever appears.
function splitBill(billText, tipText, peopleText) {
  const bill = toPence(billText);
  if (bill === null || bill === 0) return { ok: false, error: "Enter a bill above zero, two decimals at most, like 45.60." };
  if (bill > MAX_PENCE) return { ok: false, error: "Bill too large: the limit is 1,000,000.00." };
  const tenths = toTenths(tipText);
  if (tenths === null || tenths > 1000) return { ok: false, error: "Enter a tip from 0 to 100, one decimal at most." };
  const peopleClean = String(peopleText).trim();
  const people = /^\d+$/.test(peopleClean) ? Number(peopleClean) : 0;
  if (people < 1 || people > 100) return { ok: false, error: "Enter 1 to 100 people, as a whole number." };

  const tip = Math.floor((2 * bill * tenths + 1000) / 2000); // tip rounded to the nearest penny, halves up
  const total = bill + tip;
  const base = Math.floor(total / people);
  const extra = total % people; // this many people pay one penny more, so the shares add up exactly
  const shares = Array.from({ length: people }, (_, i) => base + (i < extra ? 1 : 0));
  return { ok: true, bill, tip, total, shares };
}

function render() {
  const r = splitBill(el("bill").value, el("tip").value, el("people").value);
  el("error").textContent = r.ok ? "" : r.error;
  if (!r.ok) { el("result").textContent = ""; return; }
  const low = r.shares[r.shares.length - 1];
  const morePay = r.shares.filter((s) => s > low).length; // people who pay the extra penny
  const each = morePay === 0 ? "Each person pays " + money(low)
    : morePay + " pay " + money(low + 1) + " and " + (r.shares.length - morePay) + " pay " + money(low);
  el("result").textContent = ["Bill " + money(r.bill), "Tip " + money(r.tip), "Total " + money(r.total), each].join("\n");
}

// Self-check. The expected shares (in pence) were worked out by hand, not by this code.
const CASES = [
  ["90", "10", "4", [2475, 2475, 2475, 2475]],
  ["100", "0", "3", [3334, 3333, 3333]],
  ["10.10", "12.5", "2", [568, 568]],
  ["0.10", "5", "1", [11]],
  ["0.01", "0", "3", [1, 0, 0]],
  ["1000000", "100", "100", Array(100).fill(2000000)],
  ["90", "10", "0", "error"],
  ["-5", "10", "2", "error"],
  ["", "10", "2", "error"],
  ["90", "10", "2.5", "error"],
  ["12.345", "10", "2", "error"],
  ["1000000.01", "10", "2", "error"],
];

function runChecks() {
  let failed = 0;
  const lines = CASES.map((c) => {
    const r = splitBill(c[0], c[1], c[2]);
    const pass = JSON.stringify(r.ok ? r.shares : "error") === JSON.stringify(c[3]);
    if (!pass) failed++;
    return (pass ? "PASS " : "FAIL ") + JSON.stringify(c.slice(0, 3));
  });
  lines.push(failed ? failed + " check(s) FAILED" : "All " + CASES.length + " checks passed");
  return lines.join("\n");
}

["bill", "tip", "people"].forEach((id) => el(id).addEventListener("input", render));
el("check").addEventListener("click", () => { el("checks").textContent = runChecks(); });
render();
</script>
</body>
</html>

The code counts money in whole pence because JavaScript's ordinary numbers are binary floating point (MDN): in Microsoft Edge, which ran every test here, 0.1 + 0.2 gives 0.30000000000000004, while whole numbers are exact up to 9,007,199,254,740,991. It hands out leftover pennies so the shares add up, formats with Intl.NumberFormat (en-GB, GBP: two decimals by default for pounds) and shows results with textContent.

Try it yourself · Activity 02

20 min

Make one small change, safely

Change one thing, using a saved copy, and let the self-check judge it.

Save the app in bill-splitter as plain text named index.html, not index.html.txt (from your assistant, or copy the example). Press Run self-check: the example prints All 12 checks passed.
Copy index.html to index-copy-01.html, then work only on index.html.
Lower the limit from 100 people to 20: change people > 100 to people > 20 and Enter 1 to 100 people to Enter 1 to 20 people (or make a similar small change to your own app). Reload and press Run self-check.
If a check fails, decide whether the change or the check is wrong. Fix the check if the change is right; otherwise copy index-copy-01.html back over index.html.

What would you have missed without the copy and the check?

Worked answer

The self-check prints FAIL ["1000000","100","100"] and ends 1 check(s) FAILED: that case uses 100 people, which the page now refuses. The change is wanted, so the check is stale. Replace it with ["1000000", "100", "20", Array(20).fill(10000000)] and add ["90", "10", "21", "error"]. The next run ends All 13 checks passed.

Next chapter

Learn in your browser · Chapter 03 of 05

Read what you were given

Read code before you run it. You need not understand every line, only ask the right questions.

Use this checklist on any code you are given. Your editor's find tool will locate the words in the right-hand column.

Scroll sideways to see every column.

Read what you were given · Table 2
Ask	Look for
1. What does it read?	Only your fields, or also files, cookies, the clipboard?
2. What does it change?	Only the page, or also files, settings, stored data?
3. What does it send, and where?	`fetch`, `XMLHttpRequest`, `sendBeacon`, `WebSocket`, `src=`, `action=`, any address starting `//` or `http`.
4. What does it store?	`localStorage`, `sessionStorage`, `cookie`, `indexedDB`.
5. Does it treat text as code?	`eval`, `new Function`, `innerHTML` filled with typed text.
6. What if the input is bad?	Empty, negative, zero, text, huge, too many decimals.
7. Are the sums right on awkward cases?	Rounding, half a penny, remainders. Run your examples.
8. Did you ask for all of it?	Extra features, analytics, libraries, outside scripts.

OWASP and MDN advise textContent, not innerHTML, for untrusted text. OWASP warns against eval on user input and recommends allow-list validation with minimum and maximum checks, as the example page does. Browser developer tools list what a page requested and show console errors (MDN): under test, the example page requested only itself.

A flawed example. This assistant-style code, written for this workbook, has four planted defects. Read it; do not run it. It assumes a page like the working one, plus a button with the id go.

js · 11 lines

// EXAMPLE ONLY: assistant-style code with four planted defects. Read it. Do not run it.
function splitBill() {
  var bill = parseFloat(document.getElementById("bill").value);
  var tip = document.getElementById("tip").value;
  var people = parseInt(document.getElementById("people").value);
  var total = bill + bill * tip / 100;
  var each = Math.floor(total / people * 100) / 100;
  navigator.sendBeacon("//stats.example.invalid/log", "bill=" + bill + "&people=" + people);
  document.getElementById("result").innerHTML = "Each person pays £" + each.toFixed(2) + " (tip " + tip + "%)";
}
document.getElementById("go").addEventListener("click", splitBill);

Ask the assistant to explain and critique itself: "Explain this line by line for a beginner, then list the five likeliest bugs or unsafe behaviours and what you assumed." That points you at things to check, but is not proof: the explanation is generated like the code, so it can be fluent and wrong. For code that matters, the NCSC says you need to review, understand, check for vulnerabilities and verify, and another AI agent could help. Proof is what you run yourself.

Try it yourself · Activity 03

20 min

Find the four planted defects

Review the flawed example against the checklist.

Say in your own words what the code does.
Find four problems. For each, name the checklist question that exposes it and write a one-sentence fix.

Which defect would be hardest to spot behind a confident explanation?

Worked answer

1. Sending (question 3): sendBeacon posts the bill and headcount to another site, unasked (MDN: an HTTP POST meant for analytics). Delete it. 2. Lost pennies (question 7): shares are rounded down in floating point, so with no tip, 100 among 3 shows £33.33 each (99.99 in all) and 0.58 between 2 shows £0.28 each, because 0.29 * 100 is 28.999999999999996 in Edge. Count whole pence and share the remainder. 3. Bad input (question 6): with 90.00 and 10%, zero people shows £Infinity, -2 people £-49.50 and 2.5 people becomes 2; an empty bill shows £NaN. Validate and refuse. 4. innerHTML (question 5): a tip of <b>hi</b> became a real bold element. Use textContent. (Tested in Edge from a local server, requests blocked: each click sent a POST such as bill=90&people=4. Opened as a file, it shows nothing: beacons need HTTP.)

Next chapter

Learn in your browser · Chapter 04 of 05

Test it: examples first, then the awkward cases

A test is a question with an answer you worked out first. Believe the result over the explanation.

Test in two rounds. Examples first: your brief's cases, with answers worked out by hand. Edge cases second: the limits, where mistakes hide, such as zero, one, the largest value, empty, negative, text, extra decimals, a leftover penny and a tie at half a penny.

Never take expected answers from the assistant's code: a test that copies the code's answer cannot fail.

What the example page showed in Edge, without its Bill line. Valid rows match hand-worked answers; refused rows were meant to be refused.

Scroll sideways to see every column.

Test it: examples first, then the awkward cases · Table 3
Bill	Tip %	People	What the page showed
90	10	4	Tip £9.00. Total £99.00. Each person pays £24.75.
100	0	3	Tip £0.00. Total £100.00. 1 pay £33.34 and 2 pay £33.33.
0.10	5	1	Tip £0.01. Total £0.11. Each person pays £0.11.
0.01	0	3	Tip £0.00. Total £0.01. 1 pay £0.01 and 2 pay £0.00.
1000000	100	100	Tip £1,000,000.00. Total £2,000,000.00. Each person pays £20,000.00.
1000000.01	10	2	Refused: Bill too large: the limit is 1,000,000.00.
90	10	0	Refused: Enter 1 to 100 people, as a whole number.
-5	10	2	Refused: Enter a bill above zero, two decimals at most, like 45.60.
(empty)	10	2	Refused, with the same bill message.
12.345	10	2	Refused, with the same bill message.

Two rows deserve a look. At 0.10 and 5% the tip is exactly half a penny, which the brief's rule (halves round up) makes 1p. For 0.01 among three the shares add up, but two people pay £0.00: you may decide to refuse that. It is your decision, not the assistant's.

Press Run self-check and it prints this:

text · 13 lines

PASS ["90","10","4"]
PASS ["100","0","3"]
PASS ["10.10","12.5","2"]
PASS ["0.10","5","1"]
PASS ["0.01","0","3"]
PASS ["1000000","100","100"]
PASS ["90","10","0"]
PASS ["-5","10","2"]
PASS ["","10","2"]
PASS ["90","10","2.5"]
PASS ["12.345","10","2"]
PASS ["1000000.01","10","2"]
All 12 checks passed

A further 20,000 random inputs in Edge (14,026 valid, 5,974 refused) matched a separate calculation in Python's decimal module exactly. That shows the code follows its rules, not that the rules are right.

Do not trust built-in rounding. In Edge, 1.005 * 100 gives 100.49999999999999, so Math.round(1.005 * 100) gives 100, not 101; MDN's toFixed page warns that decimal fractions cannot be represented precisely in floating point. Choose your rule, keep money in whole pence and test the ties.

Try it yourself · Activity 04

20 min

Test the splitter with new edge cases

Work out five cases by hand first, then check them on the page and in the self-check.

Without opening the page, work out each result in whole pence: (a) 250.00, tip 12.5, 6 people. (b) 0.05, tip 10, 2 people. (c) 50.00, tip 100.1, 2 people. (d) 7.00, tip 0, 100 people. (e) 1000000, tip 0.1, 1 person.
If you made exercise 2's change, copy index-copy-01.html over index.html, so the limit is 100 people again. Check each case on the page, then add yours inside the CASES list, before its closing ];, with shares in pence, and press Run self-check.

Which case would you have got wrong by trusting the page?

Worked answer

(a) Tip 31.25, total 281.25 = 28,125 pence: 4,687 each with 3 left, so 3 people pay £46.88 and 3 pay £46.87: ["250.00", "12.5", "6", [4688, 4688, 4688, 4687, 4687, 4687]]. (b) The half-penny tip rounds up to 1p; total 6p, £0.03 each: ["0.05", "10", "2", [3, 3]]. (c) Refused, tip above 100: ["50.00", "100.1", "2", "error"]. (d) 700 pence over 100 people, 7p each: ["7.00", "0", "100", Array(100).fill(7)]. (e) Tip 1,000.00, total £1,001,000.00 (only the bill is capped): ["1000000", "0.1", "1", [100100000]]. The page showed exactly these in Edge, and the self-check ended All 17 checks passed.

Next chapter

Learn in your browser · Chapter 05 of 05

Stay safe, respect the rules, know when to stop

A few habits stop a beginner's experiment becoming a real problem.

Keep secrets and personal data out. Never paste passwords, keys, tokens or other people's details into an assistant or its code. What you type usually goes to someone else's service, and OWASP warns that sensitive data you provide may later be disclosed. Use made-up data. If you paste a real secret by mistake, treat it as exposed and replace it where it was issued.

Treat code as from a stranger. OWASP notes that models can suggest libraries that do not exist, and describes attackers publishing malicious packages under commonly invented names. A script loaded from another site runs with the same privileges as the page's user and can change at any time (OWASP). This project needs neither: if an assistant adds one, ask why and leave it out.

Agents that run commands use your permissions, so a mistaken instruction can change or delete real files fast. OWASP calls this excessive agency (too much functionality, permission or autonomy) and advises the minimum necessary, with human approval for high-impact actions. In practice:

Work only in a scratch folder of copies, never in your documents, home or system folders.
Read every permission prompt, approve one action at a time, and refuse what you cannot explain.
Ask for a dry run: "List the commands you would run and what each would change. Do not run them."
Keep a saved copy of anything it may edit, and keep secrets out of the folder.

Licences and terms. This is not legal advice, and rules vary. Check your tool's terms (who owns what it produces, what happens to what you type) and the licence of any code it reproduces. GOV.UK says copyright protects original work, including software, automatically in the UK and stops others using it without permission, and that an owner can license its use. Before you sell or publish the app, check again and take advice.

Know when to stop. Learn the language properly when you cannot explain a line, when a bug keeps returning, or when the app will handle real money, logins or other people's data: what suits a prototype does not suit authentication, as the NCSC's spectrum shows. The Python: from first script to a useful automation workbook teaches a language from nothing, and Build and launch a website with AI has a ten-minute primer on this project's HTML, CSS and JavaScript.

Try it yourself · Activity 05

15 min

Write your rules of engagement

Write a one-page set of personal rules for using an AI coding assistant.

Write at least eight rules, each starting with a verb: what you never paste, where an agent may work, what needs your approval, what you check before running code, how you test, how you keep copies, what you check before sharing, when you stop and learn.
Beside each rule, note the mistake it prevents.

Which rule will you be tempted to break?

Worked answer

A model set (yours will differ), with the mistake each prevents in brackets. 1. Never paste secrets or other people's details; use made-up data (a leak). 2. Let an agent work only in a scratch folder of copies (lost files). 3. Read every permission prompt and ask for a dry run first (an unexplained command). 4. Check new code against the checklist before running it (hidden sending). 5. Work out answers by hand, then test the awkward cases (confident wrong sums). 6. Save a numbered copy before each change (no way back). 7. Check the tool's terms and any code licence before sharing (a breach). 8. Stop and learn when I cannot explain the code, a bug keeps returning, or real money or people's data are involved (code beyond me). Check yours covers all eight topics.

Assessment options

Keep learning

The complete workbook

This workbook builds one small project, a bill splitter that runs in your browser, with any kind of AI coding assistant: a chat assistant, an editor assistant or an agent. You will write a brief, build in small steps, review the code against a checklist, test the awkward cases and keep working copies. It also covers what never to paste, how to work safely with agents, and when to stop and learn the language properly.

01
What an assistant is, and how to brief one
An assistant writes code in seconds. Checking it is your job, and a clear brief helps.
Read here · 1 exercise
02
Build in small steps, and keep a working copy
Ask for one small piece, check it, save a copy, then ask for the next.
Read here · 1 exercise
03
Read what you were given
Read code before you run it. You need not understand every line, only ask the right questions.
Read here · 1 exercise
04
Test it: examples first, then the awkward cases
A test is a question with an answer you worked out first. Believe the result over the explanation.
Read here · 1 exercise
05
Stay safe, respect the rules, know when to stop
A few habits stop a beginner's experiment becoming a real problem.
Read here · 1 exercise

Also inside: a 10-point checklist, a glossary of 12 terms and 10 questions and answers to test yourself. 5 hands-on exercises, each with a worked answer at the back where the workbook gives one.

Download all 5 chapters as PDF (PDF, 2.0 MB)

The PDF is free. We ask for your name and email before downloading. Read the privacy notice at the download form. Free to download and use for personal learning, study groups and inside your own team. Please do not resell the workbooks or republish them as your own. Link people to trust-agent.ai instead.

Get your free PDF workbook

Enter your name and email, then download the complete workbook. This form also works without JavaScript.

Test yourself

Questions and answers

What is vibe coding, and is it a good way to start?

Vibe coding means giving an AI a high-level prompt and accepting what it builds with little review of the code. It can suit a throwaway prototype. It teaches little, because you never learn why the code works or whether it is safe. This workbook keeps you in the loop: brief, small steps, reading and testing.

Do I need to know how to code first?

No, but you must be willing to read. A small project like this one is a good start, and the checklist helps you question code you only half understand. Stop and learn the language properly when you cannot explain a line after asking for an explanation, when the same bug keeps returning, or when real money or other people's data are involved.

Why can code that looks right be wrong?

An assistant predicts text that is likely to fit your request. That makes code look tidy and confident whether or not it is correct. OWASP describes answers that sound correct but are unfounded. Only running the code against examples you worked out yourself shows whether it is right.

Which assistant should I use?

This workbook does not rank or recommend tools, and features and terms change often. The steps here work with any kind. Before you choose, read the tool's terms: what happens to what you type, who owns the output, and what it may access on your computer. A chat assistant sees only what you give it; editor assistants and agents can reach your files.

How can I tell whether code is safe to run?

You cannot be certain, but you can ask good questions: what does it read, change, send and store, does it treat text as code, and what happens on bad input? Search for network calls and scripts from other addresses. Open the page with developer tools showing and check the list of requests. Try it first where nothing important is at stake.

If the assistant explains its own code, is that proof it works?

No. The explanation is generated in the same way as the code, so it can be fluent and wrong. Asking for an explanation and a self-critique is still worth doing, because it points you at things to check. For code that matters, the NCSC says you need to review, understand and verify, and another AI agent could help. Your own passing tests are the proof.

Why does the bill splitter count in pence?

Ordinary JavaScript numbers store decimals in binary, so many, such as 0.1, are not exact and sums drift: 0.1 + 0.2 gives 0.30000000000000004 in Edge. Whole numbers are exact up to 9,007,199,254,740,991. Counting pence keeps every step exact and lets the page share leftover pennies so the shares always add up to the total.

What must I never paste into an assistant?

Passwords, keys, tokens, other people's personal details, and anything you are not allowed to share. What you type usually goes to someone else's service, and OWASP warns that sensitive data you provide may later be disclosed. Use made-up sample data. If you paste a real secret by mistake, treat it as exposed and replace it at the service that issued it.

Is it safe to let an agent run commands on my computer?

Only with care. An agent uses your permissions, so a mistaken action can change or delete real files. OWASP advises minimum permissions and human approval for high-impact actions. Use a scratch folder of copies, read every permission prompt, approve one action at a time, ask for a dry run first and keep secrets out of the folder.

Can I use and share what an assistant writes?

This workbook cannot give legal advice, and terms and laws vary. Check your tool's terms about who owns and may use its output, and the licence of any code it reproduces. GOV.UK says copyright protects original work, including software, automatically in the UK. If you plan to sell or publish the app, check again and take advice for anything important.

Write as you go

My notes

Use this scratchpad for your own notes, working or answers as you read. Notes are saved in this browser on this device. Downloading makes a local copy; it does not send your notes to Mickai.

Consolidate your learning

Review your work

Work through the exercises and questions, then compare your reasoning with the worked answers. A scored exam and verifiable certificate are not yet available for this course.

Review the questions

Learn the language

Key terms

AI coding assistant: A tool that writes, edits and explains program code from a description in plain words. It predicts likely text, so its code can look right and be wrong.
Vibe coding: Building software by giving high-level prompts and accepting what an AI produces, with little review of the code itself.
Agent: An assistant that acts for you: it edits files and runs commands itself, within the permissions you give it.
Brief: A short written description of what a program is for, what goes in, what comes out and what it must never do, with worked examples.
Hallucination: A confident answer that is unfounded or false, such as code that calls a library or function that does not exist.
Floating point: The way ordinary computer numbers store decimals, in binary. Many decimals, such as 0.1, cannot be stored exactly, so sums can be slightly off.

6 of the workbook's 12 terms. The complete glossary is in the workbook.

Follow the evidence

Sources and checks

Facts last checked: 2026-09-26.

Examples in this workbook were run on: Microsoft Edge 153.0.4234.48 (system install, headless) driven by Playwright for Python 1.59.0 with the msedge channel, test scripts in Python 3.12.10, on Windows 11 (2026-09-26).

These workbooks use AI assistance. See how the workbooks are made.

NumberMDN Web Docs
Number.prototype.toFixed()MDN Web Docs
Intl.NumberFormat() constructorMDN Web Docs
Element: innerHTML propertyMDN Web Docs
Node: textContent propertyMDN Web Docs
Navigator: sendBeacon() methodMDN Web Docs
What are browser developer tools?MDN Web Docs
DOM based XSS Prevention Cheat SheetOWASP Cheat Sheet Series
Input Validation Cheat SheetOWASP Cheat Sheet Series
Third Party Javascript Management Cheat SheetOWASP Cheat Sheet Series
LLM06:2025 Excessive AgencyOWASP Gen AI Security Project
LLM09:2025 MisinformationOWASP Gen AI Security Project
LLM02:2025 Sensitive Information DisclosureOWASP Gen AI Security Project
The 'vibe coding spectrum' approach to AI-assisted software developmentNational Cyber Security Centre (NCSC)
How copyright protects your work: OverviewGOV.UK
How copyright protects your work: License and sell your copyrightGOV.UK

Created by Mickarle Wagstaff-Irons - Micky Irons with the Mickai team. Published by Mickai LTD. Last updated 26 September 2026.

NextKeep going

Where to go next

Level 2Getting going 140 min

Python: from first script to a useful automation

A complete beginner's route from installing Python to a tested, dry-run-first tool that sorts and reports on a folder, using only what comes with Python.

Start course online Download PDF

Level 2Getting going 120 min

Build and launch a website with AI

Plan a simple site, have AI write the HTML and CSS, understand and check the code, then publish it free with HTTPS and sound search, accessibility and privacy basics.

Start course online Download PDF

Level 2Getting going 75 min

What is an AI agent? Agentic AI explained

A plain-English guide to AI agents: how they differ from chatbots and workflows, the parts and the loop, levels of autonomy, the main risks and how to keep a human in control.

Start course online Download PDF