Security-Focused Guide for AI Code Assistant Instructions

What it is

The Open Source Security Foundation (OpenSSF) publishes practical security guidance for developers. This guide, from its Best Practices and AI/ML working groups, focuses on one question: what should you tell an AI code assistant so the code it writes is more secure? It is free, open source and maintained in the working group's GitHub repository.

What it covers

• A short summary with sample instructions you can adapt for an instructions file.
• Secure coding principles: input validation, authentication, error handling, secure defaults, testing and data protection.
• Software supply chain security: choosing and checking dependencies.
• Platform and runtime considerations.
• Language-specific guidance for memory-unsafe languages such as C and C++, memory-safe languages such as Rust and Go, and dynamic languages such as Python and JavaScript.
• Standards to reference, such as the OWASP Top 10, OWASP ASVS and the CWE Top 25.

Its most useful ideas

The guide starts from a principle every AI user should keep: the developer remains in control of the code and responsible for any harm. From there it recommends explicit, specific security requirements rather than relying on the model's defaults; asking the assistant to review and improve its own output; and running automated tools such as static analysis and dependency checkers as part of the loop. It also notes that telling the assistant to adopt an expert persona does not help and can make results worse, a useful correction to a common habit.

Is it worth your time?

Yes, for about an hour. Read the summary and the principles, then pick the sections for your language and platform. Turn what applies into five to ten short, concrete rules in your CLAUDE.md, .cursor/rules or .github/copilot-instructions.md. That hour protects every future session.

Prerequisites

Basic web security vocabulary helps: SQL injection, cross-site scripting and why secrets must stay out of code. The OWASP Top Ten is a good companion if those are new.

How it fits the Coding with AI tools roadmap

The Sefism roadmap uses this guide in the security and licences stage, where you write security rules for your instructions file, and it pairs naturally with the secret scanning and static analysis tools in the same stage.

Common questions

Is it tool-specific? No. The advice applies to any AI coding assistant; you adapt the wording to your tool's instructions file.