Agent Security — AI App Security Resources

A workflow crossing staged security gates and an exact approval lock before production

Jul 17, 20266 min read

Keep AI Agents Away From Production Deletes

Block standing production delete authority with separate identities, permission ceilings, exact approvals, short-lived access, and audit records.

Repository rule planes with one altered layer isolated from the agent path

Jul 17, 20266 min read

Protect AGENTS.md and Rules Files From Poisoning

Prevent prompt injection in AGENTS.md and coding-tool rules with provenance, code ownership, protected review, scoped rules, and conflict tests.

A protected data chamber separated from an external assistant path

Jul 17, 20266 min read

What not to share with AI coding assistants

Do not share live credentials, customer data, regulated records, unreleased business information, or code outside your authorized policy.

Independent evidence crossing an exact changed scope and joining a candidate finding

Jul 17, 20266 min read

A Security Review Prompt That Does Not Replace Testing

Use a bounded AI security review prompt to produce traceable candidate findings, safe test ideas, and explicit uncertainty without mistaking output for proof.

A compact system connected to a backup artifact and verified restore path

Jul 17, 20266 min read

Test Backup Restore Before Agents Touch Production

Prove backup recoverability in an isolated restore drill before a coding agent receives destructive production access.

One permitted tool path crossing an approval gate while others remain closed

Jul 17, 20267 min read

Prevent CI/CD Agents From Becoming a Confused Deputy

Keep untrusted pull requests outside privileged CI jobs with narrow tokens, protected deployments, bound OIDC claims, and verified artifacts.

Jul 17, 20266 min read

Secure a Claude Code Project

Constrain Claude Code permissions, sandbox access, MCP tools, and release actions while keeping the coding workflow useful.

A processing core inside an isolation chamber with one filtered egress path

Jul 17, 20266 min read

Secure an OpenAI Codex Project

Set Codex sandbox, approval, network, environment, and MCP boundaries, then verify code changes before any release action.

Jul 17, 20266 min read

Sandbox Coding Agents and Control Egress

Isolate coding agents with disposable workspaces, minimal mounts, non-root execution, resource limits, and explicit outbound network policy.

Data signals entering a constrained execution funnel while other paths are blocked

Jul 17, 20266 min read

Command Injection in Agentic App Workflows

Remove unsafe shell boundaries from agent tools, constrain process arguments, and isolate the external commands that remain necessary.

Jul 17, 20268 min read

Secure a Cursor-Built App Before Launch

Review Cursor data handling, project rules, dependencies, app controls, agent permissions, and independent evidence before launch.

A provenance chain crossing an approval checkpoint into a sealed build

Jul 17, 20266 min read

Secure GitHub Actions Used by Coding Agents

Harden coding-agent workflows with untrusted-input separation, minimal token permissions, pinned actions, constrained OIDC, and approval gates.

A focused system or change set crossing trust boundaries and a human evidence gate

Jul 17, 20267 min read

Human Review and Threat Modeling for Vibe Coding

Run a lightweight threat-model review for an AI-built app by mapping real data flows, assigning owners, and turning decisions into testable release checks.

Untrusted instructions crossing agent and rules planes while the control path remains isolated

Jul 17, 20266 min read

Indirect Prompt Injection in Coding Agents

Contain indirect prompt injection by separating untrusted content from instructions, limiting tools, and testing with harmless canary actions.

Jul 17, 20266 min read

Design Least-Privilege MCP Tools

Narrow MCP tools by verb, resource, schema, token audience, and approval so model-controlled calls cannot inherit broad authority.

Jul 17, 20267 min read

Stop Prompt Injection From Spreading Across Agents

Contain multi-agent prompt injection with preserved provenance, structured handoffs, separated capabilities, intent checks, and safe canary tests.

A review plane binding a change set to a sealed artifact

Jul 17, 20266 min read

How to review an AI-generated pull request

Restate intent, split the diff by trust boundary, inspect hidden artifacts, run independent tests, and require accountable human approval.

Jul 17, 20267 min read

What Never to Paste Into an AI Coding Tool

Keep live credentials out of AI tools, and use customer or regulated data only through an approved, minimized workflow with verified controls.

A scoped identity and action path crossing rate, verification, and authorization checkpoints

Jul 17, 20266 min read

Secure internal tools built by non-developers

Protect AI-built internal tools with managed identity, per-action authorization, narrow service accounts, audit logs, recovery, and a shutdown owner.

Jul 17, 20266 min read

Build a Secure MCP Server

Secure an MCP server with deliberate transport choices, audience-bound tokens, per-tool authorization, session isolation, and execution-time approval.

A browser plane outside a sealed server chamber with one controlled opening

Jul 17, 20266 min read

Secure public AI API endpoints

Protect public AI APIs with object authorization, bounded work, cost controls, constrained tools, safe output handling, and tested failure paths.

Jul 17, 20266 min read

Threat Modeling for Non-Security Founders

Build a lightweight startup threat model from assets, trust boundaries, misuse cases, mitigations, owners, tests, and review triggers.

Six layered security paths joining at a translucent evidence gate

Jul 17, 202615 min read

Vibe Coding Security: The Complete Guide

A six-layer guide to testing AI-built apps, preserving evidence, retesting fixes, and making an honest release decision.

Jul 17, 20266 min read

Secure a Windsurf Project

Control Cascade terminal actions, MCP tools, credentials, shared rules, and branch review as Windsurf moves into Devin Desktop.