AI-assisted development
5 guides tagged AI-assisted development, grouped by topic, with the SDLC phase and role each is written for.
Application security
1 guideSoftware supply chain
1 guideAI security
3 guidesSecure AI-assisted development with coding assistants and agents
Treat generated code, suggested packages, repository text and MCP servers as untrusted inputs, and confine coding agents with OS-level isolation and short-lived, narrowly scoped credentials.
Design, Development · Developers, AppSec engineers
Case study: the Nx s1ngularity compromise and its AI-assisted payload (2025)
How a pull-request-title injection in a GitHub Actions workflow on an outdated branch gave an attacker the Nx npm token in August 2025, how the malicious versions tried to turn developers' own AI command-line tools into file-search agents, and the workflow, publishing and agent controls that stop the same chain.
Design, Development, Release, Maintenance · Developers, Platform engineers and SREs
Case study: the Amazon Q Developer extension compromise (2025)
How an over-scoped GitHub token, extracted from an AWS CodeBuild pull request build, let a threat actor commit code to the Amazon Q Developer extension for VS Code that shipped in version 1.84.0 in July 2025, why the injected code aimed at the Q Developer CLI failed, and the CI and AI-agent controls the incident argues for.
Design, Development, Testing, Release, Maintenance · Developers, Platform engineers and SREs