Stage 8 · Lesson 4 of 6
Scanning code and secrets automatically
You will not catch everything by eye, so let tools check every line. Static analysis () tools such as Semgrep scan source code for bug and security patterns without running it; such as ESLint and Ruff catch many problems too. Secret scanners such as Gitleaks search files and Git history for keys and .
Run them locally, add them to CI so every is checked, and ask your agent to run them and fix findings as part of done. When a scanner finds a real secret in history, rotate the secret first; deleting it from the latest does not remove it from Git history.
Common trapadding scanners and then ignoring their warnings until nobody reads them.
A question to check yourself, an AI practice session and 2 cheat sheet entries come when you add the roadmap to your account. Add it
Resources for this stage
Start with· follow one of these
- GuideFreeSecurity-Focused Guide for AI Code Assistant Instructions
OpenSSF · Intermediate
Free guidance from OpenSSF on writing security instructions for AI coding tools
- GuideFreeOWASP Top Ten
OWASP · Intermediate
The most common web security risks, which AI-generated code repeats