DEV

AI can accelerate a customer portal build — or quietly introduce its most dangerous vulnerabilities. This episode breaks down exactly where AI assistance helps, where it genuinely hurts, and the authorization decisions every team must make on day one.

Show Notes

Building a customer portal with AI in the loop sounds like a productivity win — and it can be. But "using AI" actually describes two distinct problems that fail in completely different ways, and most teams treat them as one. This episode of DEV.co unpacks the dos and don'ts that separate a fast, safe portal build from one that ships a quiet security hole, drawing on the full guide on AI-assisted customer portal development that the episode is based on.

Here's what the episode covers:

  • Two separate scoping problems: AI as a developer productivity tool and AI as an in-product feature for end users have different risk profiles, different cost structures, and need to be audited separately — conflating them is the first and most common mistake.
  • Where AI coding assistance genuinely pays off: Repetitive CRUD endpoints, boilerplate forms, migration scripts, test fixtures, and OpenAPI specs from existing handlers — tasks where a senior engineer can review the diff and discard what's wrong in under a minute.
  • Where AI assistance becomes dangerous: Authorization logic, tenant scoping in database queries, cryptography, and payment idempotency handling are all areas where plausible-looking generated code is the failure mode, not the success condition.
  • The auth boundary decision that has to happen on day one: Tenant identity belongs in a signed token, row-level security should exist as a second line of defense at the database layer, and role-based access control should be auditor-readable — not scattered conditionals that a scaffolder quietly introduced. Broken Object Level Authorization leads the OWASP API Security Top 10 for a reason, and a portal is essentially that problem wearing a polished UI. Teams building on solid cybersecurity development practices will recognize this as foundational, not optional.
  • Building a production LLM help panel the right way: A chatbot inside a portal is a system, not a prompt — retrieval must be scoped by authenticated tenant, every prompt and response needs to be logged with tenant and user IDs, and a defined fallback to a human queue is non-negotiable when the model is uncertain.
  • Compliance and vendor data handling: Sending customer data to a hosted model makes the vendor's data practices part of your compliance posture. Strip identifiers before the prompt, pin the model and region, disable training on your traffic in writing, and retain logs with enough detail to make an incident resolvable. Teams building custom AI applications at the enterprise level will find this checklist directly applicable.

The failure modes covered — tenant data leaking through a scoped retrieval layer, a scaffolded endpoint trusting a client-supplied identifier, a chatbot citing a document the asker never had access to — are predictable, and they're preventable when the right decisions get made before anyone writes a single prompt. For more on what large-scale AI and API work actually costs and involves, the episode What Enterprise API Integration Actually Costs in 2026 is a natural companion listen.

DEV.co

RFP.co

What is DEV?

Software and web development from the side that has to ship it and then live with it. Architecture decisions with a cost attached, scoping, technical debt, hiring and vendor selection, and the AI tooling question every engineering team is now answering whether they planned to or not.

Each episode takes one decision — rewrite or refactor, framework choice, build versus buy, how to scope a fixed-bid project honestly — and works through the tradeoffs, including the ones that only show up in year two. Written for engineering leads, technical founders and the people who fund them. Five or six minutes, no hand-waving.

Topics include rewrite versus refactor, build versus buy, scoping fixed-bid work honestly, technical debt you should keep, framework and platform choices, hiring and vendor selection, code review culture, and where AI tooling actually helps.

Produced by DEV.co, web and software development. Full details, services and further reading at https://dev.co