What are Augment Code security best practices?

The best practices specific to Augment Code (not generic OWASP)

Every "security best practices" list tells you to use HTTPS and rotate keys. Those are table stakes. The list below is what actually matters for Augment Code apps, based on the risks that appear in real Augment Code deployments.

1. Close: Bypassed Security Middleware

AI-generated routes may skip the auth middleware pattern your team uses.

2. Close: Inherited Insecure Patterns

Augment learns from your codebase — if there are insecure patterns, it propagates them.

3. Close: Supply Chain Risk from AI Suggestions

Suggested dependencies may have known vulnerabilities.

4. Close: Business Logic Exposure

AI has access to sensitive enterprise code during generation.

Augment Code-specific: audit every table for RLS before every deploy

The failure mode in Augment Code + Supabase apps is always the same: a table gets added during a feature push, RLS never gets turned on, the full table becomes queryable via the anon key. Bake a pre-deploy check: `select tablename from pg_tables where schemaname = 'public' and not rowsecurity` — the result must be empty.

Verification

Even perfect best practices don't prove themselves — the only way to confirm the list above is implemented is to scan a deployed Augment Code app. VAS probes each of middleware compliance, dependency audit, pattern consistency, data access by actually attempting the attack, not just reading headers or docs.