How to build secure applications while leveraging AI coding assistants. Principles, workflows, and tools.
Don't rely on a single security measure. Layer multiple controls: input validation, parameterized queries, output encoding, authorization checks.
Even if AI misses one control, others catch the vulnerability.
When something fails or is uncertain, default to denying access rather than allowing it.
If auth check fails, return 403. If data parse fails, reject the request.
Give users and systems only the permissions they need. No more.
API keys should have minimal scopes. Users should only access their own data.
Validate all input, whether from users, APIs, or AI. Don't trust data just because it came from an 'internal' source.
Validate AI-generated code the same as external code.
Set up your AI tool with security guidelines before coding
Include security requirements in your prompts
Manually review security-critical code before accepting
Run security scanners on your codebase
Test security controls before deployment
# Security Rules for AI Assistant ## Authentication & Authorization - Every API endpoint must verify authentication - Authorization checks must happen server-side - Never rely on client-side role checks ## Data Handling - Use parameterized queries for all database operations - Validate and sanitize all user input - Never log sensitive data (passwords, tokens, PII) ## Secrets Management - Never hardcode API keys or credentials - Use environment variables for all secrets - Exclude .env files from version control ## Error Handling - Return generic error messages to users - Log detailed errors server-side only - Never expose stack traces in production
See where your AI-generated code stands. VAS scans for the vulnerabilities that AI tools commonly introduce.
Free Security ScanYes, but it requires intentionality. AI tools accelerate development but don't prioritize security. With proper configuration, security-focused prompting, code review, and automated scanning, you can build secure applications while still benefiting from AI productivity gains.
Never skip code review for security-critical paths. Authentication, authorization, data handling, and input validation code should always get human review, regardless of how confident you are in the AI's suggestions.
Use rules/context files (like .cursorrules) to establish security patterns. Include guidelines about authentication, authorization, input validation, and secret handling. The AI will reference these when generating code.
Layer multiple tools: SAST tools (Semgrep, ESLint) during development, DAST tools (VAS, OWASP ZAP) on deployments, secret detection (Gitleaks) in pre-commit hooks, and dependency scanning (Dependabot) for packages.
For non-security-critical code (UI components, styling, utilities), AI code can often be deployed with minimal review. For anything involving authentication, authorization, data access, or input handling, always review. When in doubt, review.
Last updated: January 16, 2026