Security and code audit 🔒

Security is the domain where the agent is most useful as an assistant and most dangerous as a replacement. It can scan code for secrets, vulnerable patterns, and insecure configurations in seconds. But it does not understand your business context, does not know your system’s threat model, and never replaces human review. This guide defines how to use coding agents for security within the development workflow, not how to do security engineering in general.

The agent can find what you forget. It cannot decide what is truly dangerous.

Boundaries with other content 📐

This guide does not duplicate the existing guide Security audit with generative AI. That guide focuses on prompting for security audits with generic LLMs. This guide focuses on the coding agent workflow: how to integrate security into the development cycle, how to handle agent-specific risks (prompt injection, excessive agency, MCP supply chain), and when to stop.

When to use the agent for this use case 🎯

• Secret scanning — searching for hardcoded credentials, API keys, JWT tokens in code.
• Diff analysis — reviewing changes for vulnerable patterns before merge.
• Pre-commit scanning — quick audit before every commit.
• Dependency verification — checking that introduced libraries are legitimate.
• Policy updates — generating or updating .gitignore, .ignore, security rules.

When NOT to use the agent ⛔

• Complete threat modeling — requires business domain knowledge.
• Compliance audits — GDPR, PCI-DSS, SOC2 require specialized expertise.
• Penetration testing — the agent cannot perform intrusion tests.
• Security architecture review — design decisions, not code scanning.

Opening prompt 📝

“Scan [area/file] for: hardcoded secrets, SQL injection, path traversal, XSS, plaintext credentials. Report with severity (CRITICAL/HIGH/MEDIUM/LOW) and file:line. DO NOT apply changes.”

Concrete example:

“Scan src/ for: (1) API keys, tokens, hardcoded passwords; (2) non-parameterized SQL queries; (3) path traversal in user input; (4) configs with plaintext secrets. Report with severity and exact position. DO NOT apply changes.”

Workflow 🔧

1. Filter configuration 🛡️

First, make sure secrets do not enter the agent’s session. Configure .gitignore and .ignore to exclude sensitive files.

# .gitignore — essential patterns
.env
.env.*
*.key
*.pem
credentials.json
service-account*.json

If the agent reads a .env file with real keys, those keys end up in the session context. OWASP LLM02 classifies sensitive information disclosure as a critical risk.

2. Secret scanning 🔑

Ask the agent to specifically search for credentials and secrets in the code.

“Search the codebase for: API keys (AWS, GitHub, OpenAI, Stripe), JWT tokens, hardcoded passwords, .pem certificates, connection strings with credentials. Report each occurrence with file:line.”

3. Vulnerable pattern analysis 🕵️

Request analysis for the main OWASP categories:

• SQL Injection — queries concatenated with user input
• Command Injection — shell command execution with unsanitized input
• Path Traversal — file access with user-constructed paths
• XSS — rendering unsanitized HTML
• Hardcoded Credentials — secrets in source code

“Analyze the code against: SQL injection (non-parameterized queries), command injection (exec with input), path traversal (file access with input), XSS (unsanitized HTML). For each vulnerability: severity, file:line, description, remediation.”

4. Dependency verification 📦

Check that libraries introduced by the agent are legitimate and not compromised.

“List all external dependencies imported in modified files. For each dependency: verify existence on official registry (npm, PyPI, Crates.io), report any unusual or potentially hallucinated packages.”

This step protects against slopsquatting: the agent might invent package names that exist but are malicious.

5. MCP integration audit 🔌

If the project uses MCP servers, verify they respect the principle of least privilege.

“Inspect the project’s MCP configuration. Identify servers that grant unrestricted write permissions or the ability to execute arbitrary shell commands. Suggest gating rules for high-impact operations.”

6. Report and fix 📝

Generate a structured report and apply fixes.

“Generate a tabular report: Severity | File:Line | OWASP Category | Risk | Remediation. Then apply fixes for CRITICAL and HIGH issues.”

Prompt templates 📋

Template 1 — Full audit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

CONTEXT: You are a Senior Application Security Auditor. Perform a security audit on [FILE/DIFF].
The code was generated or modified by a coding agent.

TASK: Analyze against:
1. Hardcoded Secrets (OWASP LLM02): API keys, tokens, plaintext passwords
2. Injections (OWASP LLM05): SQL, command, path traversal, XSS
3. Supply Chain (OWASP LLM03): external dependencies, hallucinated packages
4. Access Control: bypassable authorizations

FORMAT: Tabular report with Severity (CRITICAL/HIGH/MEDIUM/LOW), File:Line, OWASP Category, Risk, Remediation.

Template 2 — MCP audit

1
2
3
4
5
6
7
8

CONTEXT: Evaluate the security of configured MCP integrations.
CONFIGURATION: [MCP file]

TASK:
1. Inspect commands exposed by registered MCP servers
2. Identify excessive agency (OWASP LLM06)
3. Verify Indirect Prompt Injection vectors (OWASP LLM01)
4. Suggest human-in-the-loop gating rules

OWASP Top 10 for LLM Applications 2025 📖

Quick reference for the most relevant categories in the coding agent context:

Anti-patterns 🚫

• Blindly trusting the agent — do not fix code just because “AI generated it as secure.” A final human audit is always required.
• Ignoring OWASP — not checking output against standard categories.
• Passing sensitive data in prompts — including real .env files in the session.
• Untrusted skills/plugins — installing agents or skills from unknown sources.
• Fully delegating security review — 45% of AI-generated code contains vulnerabilities (Veracode). The agent is a pre-review, not the final review.
• Neglecting dependencies — in security too, use package scanners.

Acceptance criteria 📏

Series references 📚

• Security audit with generative AI — audit prompting (series boundaries)
• Configuring the repository — .gitignore, .ignore, configuration
• Assisted code review — security review as part of code review
• Skills, hooks and MCP — MCP integration security