Agent-Assisted SDLC Security

The flow

1. 1.Identify scope
2. 2.Inspect evidence
3. 3.Apply host control
4. 4.Run negative cases
5. 5.Compare benign behavior
6. 6.Review remaining risks

Repository text is still data

An issue, dependency README, error log or skill may contain attacker-authored instructions. Follow the trusted task and applicable repository policy; the presence of a command in a document does not authorize running it.

Map the agent tools and credentials separately from the code change. An apparently small documentation task should not inherit deployment secrets or write access to unrelated repositories.

Review execution and dependencies

Use bounded diffs, pinned dependencies, sanitized logs and read-only CI permissions where possible. Do not interpolate untrusted issue titles or model output into shell commands.

The existing delivery runner binds local checks to source bytes and keeps review pending. Its digest is not signed provenance; protected platform review and authenticated identity are separate controls.

Ship evidence without inventing approval

Attach spec, threat/failure cases, command exit codes, fixture/live-eval distinction and remaining risks. Source changes invalidate evidence for the old candidate.

The security expansion adds teaching controls and ingestion tests; it does not grant the coding agent deployment authority or claim that independent human review has occurred.

Try it

{
  "version": "2026-10-31.1",
  "owner": "Interview Preparator teaching lab",
  "assets": ["tenant documents", "approval grants", "run state", "source provenance", "resource budgets"],
  "actors": ["authenticated user", "untrusted document author", "probabilistic model", "trusted host", "authorization service"],
  "boundaries": [
    {"from":"caller", "to":"host", "control":"authenticated identity; request validation"},
    {"from":"retrieval", "to":"model", "control":"current tenant/user ACL; approved, live sources"},
    {"from":"model", "to":"tools", "control":"closed tool schema; host permission and payload-bound grant"},
    {"from":"model", "to":"UI", "control":"escaped plain text; source/claim contract"},
    {"from":"host", "to":"outside world", "control":"no external side-effect tool in this fixture; production egress enforcement is separate"}
  ],
  "risks": [
    {"id":"T-01", "threat":"document instruction redirects tool use", "owner":"host policy", "test":"injection"},
    {"id":"T-02", "threat":"valid source ID paired with false claim", "owner":"reliability evaluator", "test":"contradicted"},
    {"id":"T-03", "threat":"replayed or scope-changed write approval", "owner":"approval adapter", "test":"grant"},
    {"id":"T-04", "threat":"budget exhaustion through repeat calls", "owner":"runtime", "test":"budget"}
  ]
}

Run npm run examples:security and npm run eval:security. This source is a deterministic teaching fixture; it does not prove live model safety, NLI, production auth or OS/network isolation.

Interview questions

Official references

• OWASP GenAI LLM Top 10 2026
• OWASP Agentic Applications 2026
• OWASP SSRF prevention
• OWASP SSRF prevention
• Node permission model and constraints
• GitHub Actions secure use

Continue learning

• Conflicting & Stale Evidence →
• Testing & Evaluation for Spring AI →