Defending DevA publication on AI-assisted secure software development. Written in good faith, weekly.https://defending.dev/Secrets in generated codehttps://defending.dev/five-minute-fix/secrets-in-generated-code/https://defending.dev/five-minute-fix/secrets-in-generated-code/Assistants love a hardcoded credential. Five minutes to catch them before commit — hooks, scanner, and the prompt that prevents the habit.Wed, 01 Jul 2026 00:00:00 GMTThe junior developer who never sleepshttps://defending.dev/blog/the-junior-developer-who-never-sleeps/https://defending.dev/blog/the-junior-developer-who-never-sleeps/Review everything, mentor the prompts, never let it merge alone.Tue, 30 Jun 2026 00:00:00 GMTPrompt injection, for people who shiphttps://defending.dev/tutorials/prompt-injection-for-people-who-ship/https://defending.dev/tutorials/prompt-injection-for-people-who-ship/A working threat model, with tests you can paste into CI today.Fri, 26 Jun 2026 00:00:00 GMTWhat CISOs get wrong about copilotshttps://defending.dev/podcast/ep-07-what-cisos-get-wrong-about-copilots/https://defending.dev/podcast/ep-07-what-cisos-get-wrong-about-copilots/With Dana Okafor, CISO at Meridian Health.Wed, 24 Jun 2026 00:00:00 GMTReviewed: three SAST tools vs. assistant-written reposhttps://defending.dev/reviews/three-sast-tools-vs-assistant-written-repos/https://defending.dev/reviews/three-sast-tools-vs-assistant-written-repos/We ran three leading static analysers over a corpus of assistant-generated services. The results argue for retuning, not replacing.Tue, 23 Jun 2026 00:00:00 GMTAI slop is a supply-chain problem, not a quality problemhttps://defending.dev/blog/ai-slop-is-a-supply-chain-problem/https://defending.dev/blog/ai-slop-is-a-supply-chain-problem/Generated code enters your estate like a dependency — treat it with the same provenance discipline.Sat, 20 Jun 2026 00:00:00 GMTA one-page AI coding policy your board will signhttps://defending.dev/blog/a-one-page-ai-coding-policy-your-board-will-sign/https://defending.dev/blog/a-one-page-ai-coding-policy-your-board-will-sign/Scope, accountability, audit trail — on one page. Template included; adapt it this week.Tue, 16 Jun 2026 00:00:00 GMTThe pentest that found nothinghttps://defending.dev/podcast/ep-06-the-pentest-that-found-nothing/https://defending.dev/podcast/ep-06-the-pentest-that-found-nothing/A red-team lead on what a clean report against an AI-assisted codebase really means.Wed, 10 Jun 2026 00:00:00 GMTMetrics that survive a board meetinghttps://defending.dev/blog/metrics-that-survive-a-board-meeting/https://defending.dev/blog/metrics-that-survive-a-board-meeting/Four numbers to report quarterly, and the vanity metrics to retire.Tue, 09 Jun 2026 00:00:00 GMTSelling "yes, like this" to a sceptical boardhttps://defending.dev/podcast/ep-04-selling-yes-like-this-to-a-sceptical-board/https://defending.dev/podcast/ep-04-selling-yes-like-this-to-a-sceptical-board/How three security leaders reframed AI-assisted development from threat to governed capability.Wed, 13 May 2026 00:00:00 GMT