Full Report
Helping LLMs generate safer and more secure code through open-sourced rules files.
Analysis Summary
# Best Practices: Securing Development with AI-Assisted Coding Tools
## Overview
These practices address the security risks introduced by developers using AI-assisted programming tools (like GitHub Copilot, Claude Code, etc.), which often generate vulnerable code. The focus is on implementing validation, integrating security scanning early (Shift Left), and leveraging new mechanisms like "Rules Files" to guide AI generation towards secure outputs.
## Key Recommendations
### Immediate Actions
1. **Mandate Security Keyword Prompting:** Immediately instruct developers to include security-focused terms like "secure" or specific vulnerability avoidance requests (e.g., "Generate code that prevents top security weaknesses") in their prompts to AI assistants, as research shows this reduces weakness density.
2. **Deploy Secrets Scanning:** Ensure active secrets scanning tools are implemented to immediately catch hardcoded secrets in any code generated or subsequently modified by AI.
3. **Establish Initial Rules Files:** Begin crafting and deploying basic, company-wide "Rules Files" (custom instructions for AI tools) that enforce fundamental security standards (e.g., "Always sanitize inputs," "Never hardcode credentials").
### Short-term Improvements (1-3 months)
1. **Shift Security Tooling Left (IDE Integration):** Integrate Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Secrets scanning directly into developer IDEs, ensuring AI-generated code is reviewed concurrently with human coding.
2. **Implement Pull Request (PR) Scanning Gate:** Enforce mandatory automated scanning of all PRs using SAST and SCA tools. Remediation efforts must occur before merging to catch post-generation vulnerabilities.
3. **Develop Standardized Security Rules Files:** Formalize and centralize security guidelines within Rules Files, tailoring them by programming language where necessary to combat common language-specific vulnerabilities (e.g., deserialization risks in Python, memory issues in C/C++).
4. **Train Developers on AI Code Risks:** Conduct mandatory training sessions focusing on the high probability (25% to 70% vulnerability rate reported in benchmarks) of insecure AI-generated code and the dangers of over-reliance ("vibe coding").
### Long-term Strategy (3+ months)
1. **Adopt Secure Frameworks and Libraries:** Prioritize the creation and adoption of internal, pre-vetted, and secure-by-default software frameworks and code libraries to reduce the surface area for risky AI creations.
2. **Metric Tracking for AI Vulnerabilities:** Establish metrics to track the frequency and severity of vulnerabilities introduced via AI-generated code versus human-written code to iteratively refine security guidance and training.
3. **Refine and Centralize Rules File Management:** Establish a governance process for the lifecycle management, version control, and mandatory adoption of security-focused Rules Files across all relevant AI coding contexts (e.g., project, departmental, or enterprise-wide).
4. **Review Authorization and Authentication Practices:** Specifically review AI-generated components for common OWASP Top Ten weaknesses like CWE-306 (Missing Authentication for Critical Function), as these are frequently missed.
## Implementation Guidance
### For Small Organizations
* **Focus on Fundamentals:** Immediately implement robust Secrets Scanning and integrate basic SAST into the CI/CD pipeline for all code, prioritizing remediation of outputs flagged as high-risk.
* **Simple Rules File:** Create one concise custom instruction file (under 500 lines) applicable to the primary language used, focusing only on preventing hardcoded secrets and basic input validation.
* **Manual Review Emphasis:** Since dedicated tooling integration can be costly, enforce mandatory peer security reviews for any code block suspected of being entirely AI-generated.
### For Medium Organizations
* **Toolchain Integration:** Deploy and enforce IDE plugins for SAST/SCA tools to provide immediate feedback on AI-generated snippets.
* **Scoped Rules:** Begin developing separate, tailored Rules Files for major projects or high-risk components, addressing known historical architecture weaknesses specific to the organization.
* **Vulnerability Targeting:** Specifically engineer Rules Files to explicitly counter CWEs identified as common in AI output (e.g., CWE-94: Code Injection).
### For Large Enterprises
* **Centralized Governance:** Establish a security champions program or dedicated AppSec team responsible for curating, testing, and distributing standardized, version-controlled Rules Files enterprise-wide.
* **Framework Standardization:** Invest resource into building and hardening internal secure coding frameworks that developers must use when prompting AI assistants, effectively reducing the freedom of the LLM to introduce deviation.
* **Advanced Tooling Rollout:** Deploy advanced, context-aware security tooling that can scan code repositories specifically looking for patterns indicative of low-effort "vibe coding" or reliance on unverified external packages generated by the AI.
## Configuration Examples
As the article details the *pattern* of Rules Files, specific configuration examples are generalized based on stated research goals:
**Example Security Rule (Conceptual Content for a Rules File):**
text
// Rule Set: Security Baseline v1.0
// Objective: Mandate secure coding practices for all generated functions.
1. **Input Sanitization:** All data read from external sources (users, files, network) MUST be sanitized or validated against an allow-list schema before processing or inclusion in database queries/OS commands.
2. **Authentication Context:** Never generate code that handles authentication checks (e.g., session validation, permission checks) without explicitly calling the organization's designated 'AuthService.check()' function or equivalent.
3. **Secret Handling:** Absolutely NO secrets (API keys, passwords, connection strings) are to be embedded directly in the code. Use environment variables or the secure vault service only, indicated by placeholders like ENV_VAR_DB_PASS.
4. **Language Specific (CWE-190 Mitigation):** For integer arithmetic, ensure all boundary conditions are checked before performing addition or subtraction, particularly when dealing with user-controlled inputs.
## Compliance Alignment
* **NIST SP 800-53 (Rev. 5):** Aligns with controls related to System and Services Acquisition (SA) and Configuration Management (CM), particularly ensuring software development processes adhere to secure coding requirements.
* **ISO/IEC 27001:** Supports A.8.11 (Information Transfer) and A.8.28 (Secure Development Policy) by standardizing and enforcing secure software creation mechanisms.
* **OWASP Top 10 (2021/2024):** Direct mitigation against A01:2021 (Broken Access Control) and A04:2021 (Insecure Design) by proactively forcing security checks into the generated code via Rules Files.
* **CIS Critical Security Controls (v8):** Supports Control 14 (Software Application Security) through the mandated use of security scanning tools integrated into the development pipeline.
## Common Pitfalls to Avoid
* **Over-relying on AI Output (Vibe Coding):** Developers must avoid blindly trusting AI-generated code, especially since research indicates users *produce more vulnerable code* when using assistants due to overconfidence.
* **Treating Rules Files as Optional:** Rules Files are the primary leverage point for proactive security guidance; treating them as mere suggestions will negate their benefit.
* **Waiting for CI/CD Gate:** Relying solely on post-commit scans (SAST/SCA) is insufficient. Security scanning must be "shifted left" into the IDE, ideally catching the vulnerability before the developer even commits the insecure AI-generated snippet.
* **Ignoring Language Specifics:** Failing to tailor security rules based on the programming language used, thus missing known high-risk patterns specific to Python (deserialization) or C/C++ (memory management).
## Resources
* Information on GitHub Copilot Repository Custom Instructions (For implementing Rules Files).
* Guide on creating effective Anthropic Claude MD files (For implementing Rules Files).
* Documentation for Aider Conventions (For implementing Rules Files).
* NIST SP 800-53 (For comprehensive security control mapping).
* OWASP Top 10 list (For prioritizing threats addressed by Rules Files).