Why Faster Code Demands Smarter Security

▶ Watch (2:30)

AI lets developers build features in weeks that took months. But faster code means more vulnerabilities. Simona Toader said projects that took 6 months are now easy because LLMs evolved. The risk: more code, more attack surface. Developers shift from writing code to prompting. Human review remains essential between generation and commit. Security must be integrated into workflows, not bolted on.

Secrets: Prevention Over Detection

▶ Watch (8:29)

Toader cited 39 million secrets shared on GitHub. Even with awareness, mistakes happen. A leaked key can be exploited within minutes, leading to lateral movement and huge bills. Push protection blocks commits containing secrets at the IDE level. GitHub scans the entire organization history, not just new pushes. Prevention is cheaper than remediation: understanding the secret’s owner, permissions, and impact takes time.

Dependencies and Code Scanning: Visibility and Auto Fix

▶ Watch (18:19)

Log4j took some customers 6 months to discover they used it. Dependency review provides a hierarchy of all dependencies and their transitive ones. Code scanning with CodeQL flags vulnerabilities in code. Auto Fix can automatically upgrade dependencies or patch code. Toader emphasized that AI-generated code should be treated like developer-written code: run the same tests and scans.

Custom Agents and Instructions: Embedding Security in the Workflow

▶ Watch (29:17)

Instructions are mandatory for coding agents. They provide guidelines for secure code generation. Custom agents act as specialized personas: one for APIs, one for testing, one for security. Toader showed a security reviewer agent that analyzes code for vulnerabilities. Skills are optional context that agents load only when relevant. She used a prompt to generate skill files from tool documentation.

Building a Security Agent with Open-Source Tools

▶ Watch (45:03)

Toader demonstrated a security scanner agent using only open-source tools. The agent’s instructions forbid running any code from the analyzed project. It checks for installed tools like Bandit and Semgrep. If tools are missing, it falls back to pattern analysis. The agent produces a report with critical vulnerabilities, impact, and recommended fixes. Skills are created via a prompt that fetches tool documentation.

Notable Quotes

39 million secrets shared on GitHub. Simona Toader · ▶ Watch (8:29)

Log4j was a huge issue, right? Simona Toader · ▶ Watch (18:19)

treat it as it was developed by your developers. Simona Toader · ▶ Watch (26:59)

custom agents as a specialized persona. Simona Toader · ▶ Watch (31:27)

never run, execute, or invoke any code, script, command, or application that is being analyzed for security issues. Simona Toader · ▶ Watch (46:28)

Key Takeaways

  • Use push protection to block secrets before they reach the repository.
  • Treat AI-generated code with the same security testing as human-written code.
  • Create custom agents with instructions and skills to enforce security policies.

About the Speaker

Simona Toader is a Sr. Solution Engineer in Global Black Belt team at Microsoft, with 10+ years of experience in the tech industry focusing on cloud and software development. She works with customers to harness the power of GitHub, AI and Azure to boost productivity, improve SDLC, and deliver secure products faster. With a passion for cloud and DevSecOps, Simona is an active member of tech communities, driving innovation and making tech work smarter, not harder.