Project · Active · started
Guardrails for AI-Assisted Development
What changes in an application security programme when a growing share of code is written by AI assistants: leaked secrets, hallucinated dependencies and missing authorisation checks. Plus a pre-merge guardrail set that catches them without slowing engineers down.
Scope
AI coding assistants optimise for code that works, not code that is safe, and engineers tend to trust their output more than they should. The failure modes are predictable: credentials pasted into code, dependencies that don’t exist until an attacker registers them, endpoints that authenticate a user but never check what that user may touch.
This project treats AI-assisted development as a change to the SDLC rather than a new tool to block, and builds guardrails where they are cheapest to enforce: before merge.
Status
Scoping. Cataloguing the recurring defect classes in AI-generated changes.
Planned artifacts
- Pre-merge policy pack: secret scanning, dependency existence and reputation checks, authorisation-check heuristics
- Review checklist for AI-generated pull requests
- Guidance for configuring coding assistants and coding agents safely