The agent-native software factory
Guides on building, governing, and scaling an agent-native software factory, plus write-ups of the podcasts and talks behind the ideas.
Within Security & Governance
AI Coding Agents
Security
Session cookie tests for coding agent changes
Session cookie testing for coding agent changes verifies scope, transport protections, expiration, rotation, and logout behavior across application routes.
Read articleAI Coding Agents
Security
Keeping test data private with coding agents
Test data privacy for coding agents requires approved fixtures, restricted access, and checks that prevent sensitive records from entering prompts, logs, or commits.
Read articleAI Coding Agents
Security
Container image hardening with coding agents
Container image hardening with coding agents works best when the task fixes a measured image risk, preserves reproducibility, and produces evidence for review.
Read articleFactory Private
Compliance
SOC 2 for AI coding tools: evidence to request
SOC 2 for AI coding tools requires a review of report scope, operating period, data flows, and customer controls. Evaluate evidence instead of relying on a badge.
Read articleAI Coding Agents
Security
Keeping secrets out of agent-generated commits
Secret scanning for agent-generated commits needs limited inputs, commit-time checks, and a clear response path. Learn how to prevent credentials from entering Git history.
Read articleAI Coding Agents
Security
CSP testing for coding agent web changes
Content Security Policy testing for coding agent changes verifies directives, nonces, report-only rollout, and browser behavior without weakening protection.
Read articleAI Coding Agents
Security
SSRF testing for coding agent network changes
SSRF testing for coding agent changes verifies URL validation, network boundaries, redirects, and DNS behavior before server-side requests ship.
Read articleAI Coding Agents
Security
File upload security tests with coding agents
File upload security testing with coding agents verifies type, size, storage, authorization, and retrieval controls with reproducible fixtures.
Read articleAI Coding Agents
Security
Build provenance for coding agent artifacts
Build provenance connects coding agent artifacts to source, workflow, and inputs. Generate attestations in CI and verify them before release.
Read articleAI Coding Agents
Security
Log redaction for agent-generated changes
Log redaction review for coding agent changes starts with a data inventory, tests structured output, and verifies that useful diagnostics survive.
Read articleAI Coding Agents
Security
Webhook verification for coding agent changes
Webhook verification for coding agent changes requires raw-body signature checks, replay defenses, secret rotation, and negative tests before merge.
Read articleEnterprise AI
Security
Least-privilege access for coding agents
Least-privilege access for coding agents limits files, commands, networks, and credentials to what each task needs. Use this review checklist before granting autonomy.
Read article
