Stage 8 · Lesson 6 of 6
Security rules in your instructions file
Your instructions file is a cheap place to prevent whole classes of mistakes. Add short, concrete rules the tool can follow and you can check: use parameterised queries; validate all input at the boundary; never log secrets or personal data; never disable TLS verification; do not add a without asking; run the secret scanner and before finishing.
The OpenSSF guide to AI code assistant instructions recommends explicit security requirements like these and asking the tool to review its own output for problems, while warning that expert personas do not help. Keep the list short and specific to your stack.
Common trapcopying a generic security essay into the file, which uses context and changes nothing.
A question to check yourself, an AI practice session and 2 cheat sheet entries come when you add the roadmap to your account. Add it
Resources for this stage
Start with· follow one of these
- GuideFreeSecurity-Focused Guide for AI Code Assistant Instructions
OpenSSF · Intermediate
Free guidance from OpenSSF on writing security instructions for AI coding tools
- GuideFreeOWASP Top Ten
OWASP · Intermediate
The most common web security risks, which AI-generated code repeats