---
type: pesquisa
title: "BairesDev AppSec — AI-assisted development and AI security"
description: "AI security worldview emerging from BairesDev's current public engineering and cybersecurity content."
tags: [bairesdev, ai, ai-security, llm, code-generation, governance]
timestamp: "2026-07-20T18:30:00-03:00"
---

# AI-assisted development and AI security

## The governing principle

BairesDev's [AI coding best practices](https://www.bairesdev.com/blog/ai-coding-best-practices/) treats generated code as ordinary production code with additional provenance and verification needs. AI does not exempt a team from change control, vulnerability management, access control or compliance evidence.

## Risk clusters

### Generated-code defects

AI can reproduce insecure patterns at scale. Require tests, SAST, SCA, linting, review and build gates for every generated change.

### Dependency hallucination and slopsquatting

Generated package names may not exist or may be attractive targets. Validate packages against trusted registries and review transitive dependencies.

### Data privacy and policy ambiguity

BairesDev reports privacy and security concerns as a major barrier to client AI adoption. Define what data may enter assistants, which providers are approved, retention rules, secrets handling and human-review requirements.

### Traceability and auditability

Keep focused commits, PR approvals, test results, deployment logs and—where useful—metadata about the assistant and human modifications. The question is not whether AI was used; it is whether the organization can explain and reproduce the change.

### Agentic permissions

For agents that can read repositories, call tools or commit code, apply least privilege, sandboxing, approval boundaries, tool allowlists, output validation and kill switches. This is a synthesis from the blog's verification and governance logic, not a quoted BairesDev agent policy.

## AI-specific AppSec control loop

```text
define data/tool boundary -> generate -> validate dependencies -> test
-> SAST/SCA/secrets -> human review -> build gate -> deploy -> monitor
-> evaluate failures -> update policy and prompts
```

## Cross-links

Connect this page to [Testing and verification stack](testing-verification.md) and [Governance and metrics](governance-metrics.md).