Protect AGENTS.md and Rules Files From Poisoning
Prevent prompt injection in AGENTS.md and coding-tool rules with provenance, code ownership, protected review, scoped rules, and conflict tests.
Dependencies & pipelines
Supply Chain
Dependencies, packages, CI/CD, and third-party services — securing the code you didn't write yourself.
17published articles
AI App Pre-Launch Security Checklist
Run an evidence-based pre-launch review across authorization, secrets, inputs, dependencies, deployment, agents, monitoring, recovery, and retests.
Audit AI-Suggested Dependencies for Vulnerabilities
Verify package identity, lock resolved versions, inspect the dependency graph, and interpret advisory matches without treating a clean scan as proof.
Prevent CI/CD Agents From Becoming a Confused Deputy
Keep untrusted pull requests outside privileged CI jobs with narrow tokens, protected deployments, bound OIDC claims, and verified artifacts.
Secure a Cursor-Built App Before Launch
Review Cursor data handling, project rules, dependencies, app controls, agent permissions, and independent evidence before launch.
How to rotate and recover from an exposed API key
Respond to an exposed API key: contain access, rotate safely, verify rejection, investigate misuse, clean reachable copies, and document recovery.
Secure GitHub Actions Used by Coding Agents
Harden coding-agent workflows with untrusted-input separation, minimal token permissions, pinned actions, constrained OIDC, and approval gates.
Hallucinated Packages and Slopsquatting
Check generated package names against official registries, repositories, releases, and owners before any installation runs.
Secure npm Install Scripts and Transitive Dependencies
Inspect dependency scripts before they execute, install without production credentials, and allow only reviewed lifecycle code in npm.
Secure Node and Express APIs Generated by AI
Build an ordered Express request contract, authorize resources at every route, and verify proxy, session, limit, error, and dependency settings.
Dependency Scanning With OSV and Lockfiles
Scan resolved dependencies with OSV Scanner v2, interpret advisory matches, manage exceptions, update safely, and verify the result.
SARIF for AI Coding Workflows
Structure security results as SARIF 2.1.0 with stable rules, locations, fingerprints, redaction, validation, and honest evidence limits.
SAST vs DAST vs SCA for AI-Built Apps
Compare the evidence, timing, targets, and blind spots of SAST, DAST, and SCA, then combine them into a practical release workflow.
Secret Scanning Before Every Commit
Catch secrets in staged changes, enforce scanning on the remote, govern bypasses, keep fixtures inert, and rotate real exposures before cleanup.
Add a Security Diff Gate to Pull Requests
Build a pull-request security gate around immutable commits, explicit coverage, scanner failures, reviewable results, and one required decision.
Stop Shipping Source Maps and Private Build Artifacts
Inspect source maps, bundles, package tarballs, and CI artifacts before release so private source and files do not reach public storage.
Vibe Coding Security: The Complete Guide
A six-layer guide to testing AI-built apps, preserving evidence, retesting fixes, and making an honest release decision.