Right-Click That App. What’s Hiding in the Code?

Here’s a quick test for any single-page web app you’ve built or are using. (Single-page web apps are the kind of apps an AI chatbot can code for us in HTML.)

After publishing, open the app in your browser. Right-click anywhere on the page and choose View Page Source.

Take a look.

You’re looking at the HTML the browser received to display the app. If something is written into that source code, a student (or anyone else on the web) can read it too.

That could include a passcode, an answer key, a hint, or a student name. It isn’t really hacking. It’s simply looking at the code the browser was given.

So when you build an app with AI, write the code as if anyone and everyone will inspect it.

A few good rules

• Keep student information out. Never put student names, email addresses, ID numbers, grades, or other personally identifiable information in your app’s code.
• Don’t hide secrets in the code. If you wouldn’t want students to know a password, don’t put it in the app.
• Treat answer keys as public. If an answer is stored in the page source, assume a determined student can find it.
• Don’t confuse hidden with private. Something can be hidden on the page and still be visible in the code.

But what about apps that use student information?

Here’s an important distinction: code and data are two different things.

Code is the instructions that tell an app what to do. Data is the information the app uses or stores.

For example, the code for a name picker tells the app how to randomly select a name. The student names themselves are data.

You can build the app without putting the names into its code. Then, after the app is published, the teacher can provide the names when using it. That's what Coach B. did in his Partner Picker Wheel app.

The same idea works for an app like Secure Obscure, which lets you select photos from your computer and blur faces.

The code tells the app how to blur the photos. The photos are data the app works with. They aren’t built into the app’s code or published for everyone to see. Secure Obscure processes the photos on your device, so they don’t leave your computer.

That’s very different from asking an AI chatbot to build an app with your actual class list or student photos already included.

But there’s another important question to ask:

Where does the data go after I give it to the app?

Some apps can keep data in your browser using local storage. With an app designed this way, the information can stay on that device instead of being sent to a server.

Other apps do send data to a server. That’s a very different situation when dealing with private information.

So before putting student information into an app, find out what the app does with that data. Make sure you understand where it is stored, whether it leaves your computer, and who can access it.

One way to investigate what an app does with the data you enter is to right-click the page and choose View Page Source. You can copy the source code and paste it into an AI chatbot. Ask it to explain what the app does with the data you enter and whether that data appears to stay in your browser or be sent to a server. This isn’t a guarantee that the AI will get the answer right, but it can give you a useful starting point for understanding what’s happening behind the scenes.

And, as always, check your school or district’s technology and privacy policies before putting student information into any tool.