Control 1
Approve where coding assistants may read, write, run tests, open pull requests, and touch secrets or build workflows.
AppSec AI security
AI security for AppSec teams using coding assistants and agents.
AI can help AppSec review code, triage dependencies, explain findings, and draft fixes. The control problem is making sure AI does not quietly expand repository, secret, CI/CD, or deployment risk while it helps developers move faster.
AppSec checklist
Controls to establish before scaling coding agents.
Control 2
Require branch protection, code owners, required reviews, code scanning, secret scanning, and dependency review before AI-authored changes merge.
Control 3
Keep production credentials out of developer shells, local agents, repository tasks, and untrusted dependency install paths.
Control 4
Use disposable development containers for unfamiliar repositories, generated setup scripts, or supply-chain incident investigations.
Control 5
Ask AI to cite files, line numbers, tests, package metadata, advisories, and exploitability reasoning before accepting remediation guidance.
Control 6
Separate patch drafting from release authority; AI can propose changes, but humans and policy should approve production deployment.
AppSec reading path
AI security articles for software teams.
GitHub Security Best Practices: Branch Protection, Secret Scanning, Actions Hardening, and CodeQL Checklist
A practical GitHub security checklist for teams: branch protection, rulesets, secret scanning, push protection, Dependabot, CodeQL, GitHub Actions hardening, least-privilege access, OIDC, and SECURITY.md.
Security Claude Code Skills: Reusable AI Workflows for AppSec, SOC, and Incident Response
Claude Code skills can turn repeatable security work into reusable, reviewable workflows for secure code review, secrets triage, dependency risk, threat modeling, incident timelines, and AI governance.
How Security Teams Can Use Claude Code: AppSec, Detection Engineering, and AI-Assisted Review
Claude Code can help security teams move faster on code review, detection engineering, and incident response preparation, but only if it is wrapped in clear trust boundaries, source validation, and scoped access.
OpenAI and Trivy: How Security Teams Can Turn Vulnerability Scans into Actionable AI Triage
Trivy is excellent at finding known vulnerabilities, misconfigurations, secrets, and SBOM risk. OpenAI-style agentic security workflows can help teams turn that scanner output into prioritized, reviewable remediation without treating AI as the source of truth.
Recent Supply Chain Attacks on Trivy and Axios: Best Practices for Safer CI/CD
The recent Trivy and axios incidents show how quickly a trusted package or action can become a credential theft path, and why safer CI/CD now depends on immutability, tighter secrets handling, and faster dependency response.
Miasma Worm Turns Microsoft GitHub Repositories and AI Coding Agents into Supply Chain Risk
The Miasma worm reportedly led GitHub to disable 73 repositories across four Microsoft organizations. The campaign shows how compromised maintainer identity, CI trust, repository configuration, and AI coding agents can become one self-replicating supply chain.
AppSec implementation guides
Use AI with developer security tools safely.
AI Coding Agent Security Skills for Antigravity CLI, GitHub Copilot, Claude Code, and OpenAI Codex
Reusable security-team workflows for Antigravity CLI, GitHub Copilot CLI, Claude Code, and OpenAI Codex, including secure code review, dependency triage, CI/CD audit, sandboxed remediation, and agent governance.
Claude Code vs Codex vs GitHub Copilot vs Antigravity CLI for Security Teams
A security-focused comparison of Claude Code, OpenAI Codex, GitHub Copilot CLI, Antigravity CLI, and Cursor for secure code review, vulnerability remediation, AppSec workflows, and enterprise guardrails.
GitHub AI Security Skills for AppSec Teams
Practical AI-assisted GitHub security skills for code scanning, secret scanning, pull request review, dependency triage, and secure coding workflows.
Trivy vs Grype vs Snyk vs Wiz: Vulnerability Scanning Comparison for Security Teams
A practical comparison of Trivy, Grype, Snyk, and Wiz for vulnerability scanning, container security, SBOMs, developer workflows, and cloud exposure management.