Security-review every agent diff before merging

By vibe-coding-notes · 0 stars

We recommend a security pass on every agent diff, plus an agent environment that holds no production credentials.

### Arguments

1. Code that runs is not code that is safe. Veracode's 2025 GenAI Code Security Report found about 45% of test cases introduced a known vulnerability class, and newer models were not clearly safer.
2. Models invent package names, and attackers register them ("slopsquatting"). A 2025 USENIX Security study found hallucinated package names in about 20% of code samples across 16 models.
3. Prompt injection is OWASP's top risk for LLM applications. An agent that reads untrusted text (issues, web pages, dependency READMEs) and also holds broad write or network permissions can be steered by that text.
4. Agents take the shortest path to working code, which often means loosening a database rule, adding a temporary bypass or disabling a check.

### Risks and counterarguments

- A second agent session reviewing for security finds leads, not proof. Use it, but don't treat a clean report as sign-off.
- Checklists get skimmed. Automate what can be automated so human attention goes to auth and data access.

### What to do next

In the diff:

- [ ] Each new package exists, is the expected one and is maintained (check the registry page, not only the name); lockfile changes match intent; no unexplained install scripts or `curl | sh`.
- [ ] No keys, tokens or passwords in code, tests, fixtures, logs or history; `.env` gitignored; errors don't print secrets or personal data.
- [ ] SQL parameterized; shell calls use argument arrays; HTML escaped, no raw `innerHTML` or `dangerouslySetInnerHTML` with user data; user file paths confined to an allowed directory; safe loaders for untrusted deserialization.
- [ ] Every new endpoint checks authentication and authorization server-side, including object ownership; no leftover bypass flags, debug routes or hardcoded admins; row-level policies not loosened.
- [ ] No hand-rolled crypto or token formats; passwords hashed with bcrypt, scrypt or Argon2; TLS verification on.
- [ ] No CORS `*` with credentials; CSRF protection, security headers and rate limits intact; no tests or security checks disabled.

In the agent's environment:

- [ ] Separate dev keys, no production credentials.
- [ ] Network and shell access need approval, or the agent runs in a sandbox or container.
- [ ] Destructive commands (`rm -rf`, force push, database drops) denied or gated.
- [ ] MCP servers and plugins from trusted sources, with minimum permissions.

In CI: a secret scanner, a dependency audit (`npm audit`, `pip-audit` or equivalent) and a static analyzer.

### Sources

- https://www.veracode.com/resources/analyst-reports/2025-genai-code-security-report/
- https://socket.dev/blog/slopsquatting-how-ai-hallucinations-are-fueling-a-new-class-of-supply-chain-attacks
- https://owasp.org/www-project-top-10-for-large-language-model-applications/