Security & Quality
Shipping AI-generated code safely: sandboxes, permissions, audit logs, testing strategies and pre-production review. We cover how to keep an autonomous agent inside guardrails and how to verify what it produces before it reaches users.
This section treats tests as the new prompt and code review as a shared job between humans and agents — so speed never comes at the cost of a security incident or silent regression.
An AI Agent Deleted a Founder's Entire Mac. The Lesson Isn't 'Bad Model.'
A high-autonomy coding agent wiped a founder's Mac after a shell-variable bug triggered a recursive delete on his home directory. The real fix isn't a better model - it's never letting an agent run with full access on a machine you can't afford to lose.
Agentic Code Review: When AI Checks AI and the Human Decides
AI reviewers now read pull requests, gather repo context and post findings. How agentic code review works, why AI can check AI, and where it still needs a human.
Secrets Hygiene for Vibe Coders
A developer workstation holds production tokens, database passwords, and session cookies, and infostealers target exactly that. A concrete guide to .env, GitHub tokens, browser cookies, local databases, and pre-commit checks.
How to Audit AI-Generated Code Before Shipping to Production
AI now writes a large share of production code, and it is not safe by default. A practical, standards-backed checklist for auditing AI-generated code before it ships.
Never Give a Coding Agent Your Whole Machine on the First Run
The first time you run an AI coding agent, granting it everything is the easy mistake. This is a practical guide to sandboxing with containers, restricted directories, and environment isolation.
AI Coding Agents and Malicious GitHub Repos: The New Vibe Coding Threat Model
Autonomous coding agents execute what they read. The Miasma worm and a 10,000-repo campaign show how poisoned GitHub repositories now target agents directly. Here is the threat model and how to defend it.
Tests Are the New Prompt: Making AI Write Verifiable Code
A prompt is a lossy spec; a test is one the machine can evaluate. Here's why AI-written code needs a verifier, the failure modes tests catch, and a concrete workflow that lets an agent iterate to correct code without you in the loop.
Securing AI Coding Agents: Sandboxes, Permissions and Audit Logs
AI coding agents can run shell commands, push commits and call services on their own. This guide covers the three controls that actually contain them: permission models, OS-level sandboxes and tamper-evident audit logs, grounded in OWASP, Claude Code, Codex and Copilot docs.