Stage 8 · Lesson 3 of 6
Insecure patterns AI repeats
Models learned from public code, including insecure code, so the same flaws appear again and again: SQL built by joining strings, which allows ; HTML output without escaping, which allows cross-site scripting (XSS); eval on user input; TLS certificate checks turned off to fix a connection error; CORS set to allow any website; weak or home-made password hashing; and missing checks that the user is allowed to do the action.
Learn this list well enough to spot each in seconds during review. Put concrete rules in your instructions file, such as "always use parameterised queries", rather than asking the tool to act as a security expert, which OpenSSF's guide notes does not help.
Common trapassuming code is safe because it works and the tests pass.
A question to check yourself, an AI practice session and 1 cheat sheet entry come when you add the roadmap to your account. Add it
Resources for this stage
Start with· follow one of these
- GuideFreeSecurity-Focused Guide for AI Code Assistant Instructions
OpenSSF · Intermediate
Free guidance from OpenSSF on writing security instructions for AI coding tools
- GuideFreeOWASP Top Ten
OWASP · Intermediate
The most common web security risks, which AI-generated code repeats