14-security

Security in AI-Assisted Development

Introduction

Security is paramount in software development, and AI-assisted coding introduces both opportunities and challenges. While AI can help identify vulnerabilities, generate secure code patterns, and automate security testing, it also requires careful oversight to prevent introducing new risks. This section covers how to leverage AI for building secure applications while understanding its limitations.

AI for Secure Code Generation

Input Validation & Sanitization

AI excels at generating comprehensive input validation logic to prevent injection attacks.

Common Patterns:

• SQL Injection Prevention: "Generate a parameterized query for this user search function instead of string concatenation."
• XSS Prevention: "Create a sanitization function that escapes HTML entities in user-generated content before rendering."
• Command Injection: "Refactor this shell command execution to use safe subprocess calls with argument arrays."

Best Practices:

• Always validate on both client and server side
• Use allowlists rather than blocklists
• Never trust user input, even from authenticated users

Authentication & Authorization

AI can implement robust auth systems but requires careful review.

Implementation Areas:

• Password Handling: "Implement password hashing using bcrypt with cost factor 12 and salt generation."
• Session Management: "Create a secure session middleware with HTTP-only cookies, CSRF tokens, and expiration."
• Multi-Factor Authentication: "Design a TOTP-based 2FA flow with backup codes and recovery options."

Critical Review Points:

• Verify token generation uses cryptographically secure random numbers
• Ensure password reset tokens are single-use and time-limited
• Check that authorization checks happen on every protected route

Encryption & Data Protection

AI helps implement encryption correctly, which is notoriously error-prone.

Scenarios:

• Data at Rest: "Show me how to encrypt sensitive user data in PostgreSQL using pgcrypto with AES-256."
• Data in Transit: "Configure HTTPS with TLS 1.3 and strong cipher suites for this Node.js Express app."
• Secrets Management: "Implement envelope encryption using AWS KMS for encrypting database credentials."

Vulnerability Detection & Remediation

Static Analysis with AI

AI enhances traditional SAST (Static Application Security Testing) tools.

Workflow:

1. Code Scan: "Analyze this codebase for OWASP Top 10 vulnerabilities."
2. Context-Aware Detection: AI understands business logic to find issues traditional scanners miss
3. Fix Suggestions: "Generate a patch for this SQL injection vulnerability in the login function."

Common Findings:

• Hardcoded credentials and API keys
• Insecure direct object references (IDOR)
• Missing rate limiting on sensitive endpoints
• Improper error handling exposing stack traces

Dependency Security

AI helps manage the complex dependency landscape.

Tasks:

• Vulnerability Scanning: "Check package.json for dependencies with known CVEs and suggest secure versions."
• License Compliance: "Audit all dependencies for license compatibility with our commercial product."
• Supply Chain Attacks: "Identify dependencies with suspicious recent updates or maintainer changes."

Tools Integration:

• Snyk, Dependabot, npm audit
• Software Bill of Materials (SBOM) generation

Security Testing Automation

Penetration Testing Assistance

AI augments manual penetration testing efforts.

Capabilities:

• Test Case Generation: "Create a checklist of payloads to test for SQL injection in this search endpoint."
• Fuzzing: "Generate fuzzing inputs to test buffer overflow vulnerabilities in this C++ parser."
• Report Writing: "Draft a penetration test report with severity ratings and remediation steps for these findings."

Automated Security Scans

Integrate AI-powered scanning into CI/CD pipelines.

Pipeline Stages:

security-scan:
  - dependency-check
  - sast-analysis
  - secret-detection
  - container-scanning
  - dast-scan (staging only)

Prompt for CI:

"Add a GitHub Actions job that runs Trivy for container scanning and fails the build if critical vulnerabilities are found."

Common Security Pitfalls in AI Code

1. False Sense of Security

Risk: Assuming AI-generated code is secure by default Mitigation:

• Treat all AI code as untrusted until reviewed
• Use security checklists specific to your tech stack
• Implement defense in depth

2. Hallucinated Security Functions

Risk: AI invents non-existent security libraries or methods Mitigation:

• Verify all imports against official documentation
• Test security functions thoroughly
• Use established, well-maintained libraries

3. Outdated Patterns

Risk: AI suggests deprecated cryptographic algorithms or protocols Mitigation:

• Specify current standards: "Use Argon2id for password hashing, not MD5"
• Regularly update security dependencies
• Subscribe to security advisories for your stack

4. Logic Vulnerabilities

Risk: AI misses business logic flaws that enable authorization bypasses Mitigation:

• Manually review authorization logic
• Test edge cases in permission systems
• Implement comprehensive audit logging

Security Best Practices with AI

Secure Prompt Engineering

What you tell AI matters for security:

Do:

• "Generate code following OWASP ASVS Level 2 requirements"
• "Implement this feature with principle of least privilege"
• "Add input validation, output encoding, and CSRF protection"

Don't:

• Share real credentials, API keys, or secrets in prompts
• Paste proprietary security policies without NDA considerations
• Ask AI to bypass security controls "for testing purposes"

Code Review Checklist

When reviewing AI-generated security code:

• Are all inputs validated and sanitized?
• Is authentication required for sensitive operations?
• Are authorization checks implemented correctly?
• Are secrets stored securely (not in code)?
• Is sensitive data encrypted at rest and in transit?
• Are error messages generic (no information leakage)?
• Is there rate limiting to prevent abuse?
• Are security headers configured properly?
• Is logging implemented for security events?
• Are dependencies up-to-date and vulnerability-free?

Compliance & Regulatory Considerations

GDPR, CCPA, HIPAA

AI can help implement compliance requirements:

Data Privacy:

• "Generate a function to anonymize personal data for GDPR right-to-be-forgotten requests"
• "Create a data retention policy implementation that automatically deletes old records"
• "Implement consent management for cookie tracking compliance"

Audit Trails

• "Design an immutable audit log system for tracking all access to sensitive medical records (HIPAA)"
• "Create a tamper-evident log using hash chains for financial transactions"

Incident Response with AI

Detection & Analysis

• Log Analysis: "Analyze these server logs to identify signs of a brute force attack"
• Anomaly Detection: "Build a machine learning model to detect unusual API access patterns"

Containment & Eradication

• "Generate a script to block these malicious IP addresses across our firewall and load balancer"
• "Create a rollback plan to restore from clean backups after ransomware detection"

Post-Incident

• "Help me write a post-mortem report following the NIST incident response framework"
• "Generate lessons learned and updated security policies based on this breach"

Security Tools Enhanced by AI

IDE Plugins

• GitHub Copilot Security: Real-time vulnerability detection as you code
• Snyk Code: AI-powered static analysis for security flaws
• Semgrep: Custom rule creation with natural language

Runtime Protection

• WAF Configuration: "Generate ModSecurity rules to block SQL injection attempts"
• RASP: Runtime Application Self-Protection with anomaly detection

Threat Intelligence

• "Summarize the latest threat intelligence reports for e-commerce platforms"
• "Generate indicators of compromise (IOCs) to monitor based on recent attack patterns"

Practical Exercises

1. Secure Code Review: Analyze AI-generated code for 10 common vulnerabilities
2. Penetration Testing: Use AI to generate test cases and exploit a deliberately vulnerable app (OWASP Juice Shop)
3. Incident Response: Simulate a data breach and use AI to assist in detection, containment, and reporting
4. Compliance Implementation: Build a GDPR-compliant user data management system with AI assistance

Conclusion

AI is a powerful ally in building secure applications, but it's not a replacement for security expertise. By combining AI's ability to generate code, detect vulnerabilities, and automate testing with human judgment and security best practices, developers can create more secure software faster. The key is to maintain a healthy skepticism, verify all security-critical code, and stay informed about evolving threats and defenses.