When AI Writes the Code: Security in the Age of AI-Powered Development
AI is rapidly changing how we build websites and applications. Developers can now generate components, APIs, configuration files, tests, infrastructure code, and complete features in seconds. But faster development can also mean faster introduction of security vulnerabilities.
Details
In this talk, I will explore what happens to application security when AI becomes part of the development workflow, with practical examples from modern web development and the Plone/Volto ecosystem.
We will look at common risks in AI-generated or AI-assisted code, including:
- exposed API keys, passwords, tokens, and other secrets;
- insecure authentication and authorization;
- injection vulnerabilities and unsafe input handling;
- insecure API integrations;
- vulnerable or outdated dependencies;
- dependency and software supply-chain risks;
- unsafe configuration and infrastructure code;
- code that looks correct but makes dangerous security assumptions.
The talk will also demonstrate how developers can add automated security checks directly into their development workflow and CI/CD pipelines.
We will look at tools and techniques such as Gitleaks and TruffleHog for secret detection, GitHub Secret Scanning, Semgrep and CodeQL for static code analysis, dependency vulnerability scanners, security linters, and tools such as OWASP ZAP for testing running applications.
I will also show how AI itself can be used as an additional security assistant: reviewing code, explaining suspicious patterns, suggesting safer implementations, and helping developers understand security findings — while also discussing why AI should never replace dedicated security tools and human review.
The goal is to build a practical security workflow around AI-assisted development.