Tag
8 articles tagged Secure Coding.
AI Security
Cursor, GitHub Copilot, Claude Desktop, Codex, and VS Code all embed a browser and give it powers a normal browser withholds. Forever Security showed how a hostile page turns those powers into code execution, file theft, and address-bar spoofing.
AI Security
During MCP sign-in, the server tells your client which URL to open. In opencode and mcp-remote, a crafted URL was enough to run commands on the developer's machine.
AI Security
Coding agents obey instruction files in the folder you start them in. Start one in ~/Downloads and any web page that can save a file there can give it orders.
AI Security
Anything a prompt can influence, an attacker can influence. Here is how to handle model output safely at each place it lands: the browser, the database, the shell, and the interpreter.
Security Operations
Two critical PHP engine flaws allow unauthenticated remote code execution on ordinary PHP sites, regardless of application code. Here is what to patch, what to do if you cannot, and what to watch for.
AI Security
A system prompt is configuration the user can probably read, not a vault. Here is what to move out of it, where to put it instead, and how to test that it stays out.
AI Security
An AI agent in a GitHub Actions workflow reads attacker-controlled text while holding your tokens. Here is the threat model and a workflow design that keeps a successful prompt injection from reaching secrets.
AI Security
AI coding assistants regularly suggest packages that do not exist, and the same fake names come back again and again. Here is how slopsquatting works and the controls that stop it at review, install, and CI time.
