40%+ of AI-Generated Code Has Security Issues; We Open-Sourced a Way to Help
Source Reddit Cybersecurity
Discussion
Research indicates that over 40% of AI-generated code contains security issues, often due to missing framework- and version-specific security details. To address this, an open-source project called AI Code Security Cards provides library-specific security guidance for developers and AI coding agents. The project covers more than 60 libraries and frameworks across multiple programming languages, offering practical instructions to mitigate common security pitfalls. This initiative aims to improve the security posture of AI-generated code by guiding coding agents on unsafe defaults, validation, authentication patterns, and security changes between library versions.
r/cybersecurity (opens in a new tab)u/One_Grade4350 points0 comments
Hi everyone,
AI coding agents can develop code that works, but they often miss framework- and version-specific security details.
So we built AI Code Security Cards: open-source set of library-specific practical security instructions for coding agents.
The cards guides AI agents to cover points like unsafe defaults, validation, auth patterns, and security changes between library versions. We currently have cards for 60+ libraries and frameworks across various languages, including Django, FastAPI, Rails, Spring Framework, Laravel, Express, React, and several Go and Rust frameworks.
This project is a continuation of my PhD research on LLM-generated code. Our work and other studies have found security issues in a substantial share of generated code, including more than 40% in various evaluations.
The easiest way to use the cards is by installing the AI skill. You can find installation instructions in the GitHub repository or on the website’s integration page. You can also browse the cards on the website or add individual cards directly to your agent’s rules.
Website: https://securitycards.rewarelabs.com/
GitHub: https://github.com/Reware-Labs/securitycards
Would love feedback on:
- Which libraries we should cover next?
- Where this would fit in your workflow?
- What security failures have you seen in AI-generated code?
- What would make the cards more useful or trustworthy?