Security Learning Center
Your comprehensive guide to AI coding security, ACSM, and modern application security concepts.
ACSM Core
AI-Generated Code Security Risks
AI coding tools can introduce security vulnerabilities just like human developers. Learn about the unique risks and how to address them.
AI code securityAI vulnerabilitiescode generation risks
Secure by Design in AI Development
Secure by design means building security into software from the start rather than adding it later. Learn how this principle applies to AI-assisted development.
secure by designsecurity architectureproactive security
Understanding AI Coding Agents
AI coding agents are autonomous software systems that can write, modify, and debug code by understanding natural language instructions and project context.
AI coding agentscoding assistantcode generation
What is Agentic Coding Security Management (ACSM)?
ACSM is a security discipline focused on securing AI-assisted software development environments with real-time guardrails for AI coding agents.
ACSMagentic coding securityAI security
What is Agentic Coding?
Agentic coding refers to AI systems that autonomously write, modify, and manage code with minimal human intervention, operating as intelligent coding agents.
agentic codingAI codingautonomous coding
Comparisons
ACSM vs DAST: Static vs Real-Time Security
Compare Agentic Coding Security Management (ACSM) with Dynamic Application Security Testing (DAST) to understand their different roles in application security.
ACSM vs DASTdynamic testingruntime security
ACSM vs SAST: What's the Difference?
Understand the differences between Agentic Coding Security Management (ACSM) and Static Application Security Testing (SAST), and when to use each approach.
ACSM vs SASTcode securitystatic analysis
Best AI Code Review Tools for Security in 2025
A comparison of AI-powered code review tools for security, including Corridor, Greptile, CodeRabbit, and Snyk.
AI code reviewcode review toolssecurity tools
Best AI-Native SAST Tools in 2025
A look at AI-native static analysis tools built for modern development workflows, including real-time security for AI coding agents.
AI-native SASTAI security toolsmodern SAST
Best SAST Tools for Code Security in 2025
A comparison of the top static application security testing (SAST) tools, including Corridor, Semgrep, SonarQube, and Checkmarx.
SAST toolsstatic analysiscode security
Traditional Security
Application Security (AppSec) Fundamentals
Application security focuses on finding, fixing, and preventing security vulnerabilities in software applications throughout their lifecycle.
AppSecapplication securitysoftware security
Cross-Site Scripting (XSS)
Cross-site scripting allows attackers to inject malicious scripts into web pages viewed by other users. Learn about the different types and how to prevent them.
XSScross-site scriptingweb security
DevSecOps: Integrating Security into CI/CD
DevSecOps integrates security practices into the software development lifecycle, automating security testing and making it part of the development workflow.
DevSecOpsCI/CD securityshift left
Infrastructure Scanning and Configuration Security
Infrastructure scanning tools analyze configuration files for security misconfigurations in cloud resources, containers, and infrastructure-as-code templates.
infrastructure scanningIaC securitycloud security
Secrets Detection: Preventing Credential Leaks
Secrets detection tools scan code and commits for accidentally exposed credentials, API keys, and other sensitive data before they reach version control.
secrets detectioncredential scanningAPI key security
Software Supply Chain Security
Supply chain attacks target the dependencies and build processes that software relies on. Learn about the risks and how to protect your projects.
supply chain securitydependency securitynpm security
SQL Injection Prevention
SQL injection occurs when user input is improperly included in database queries, allowing attackers to manipulate or extract data. Learn how it works and how to prevent it.
SQL injectionSQLidatabase security
Vulnerability Management Best Practices
Vulnerability management is the process of identifying, evaluating, and addressing security vulnerabilities in software and systems.
vulnerability managementsecurity operationsrisk management
What is Common Weakness Enumeration (CWE)?
CWE is a community-developed list of software and hardware weakness types, providing a common language for describing security vulnerabilities.
CWECommon Weakness Enumerationvulnerability types
What is Dynamic Application Security Testing (DAST)?
DAST tests running applications by simulating attacks to find runtime vulnerabilities like authentication issues and server misconfigurations.
DASTdynamic testingruntime security
What is Interactive Application Security Testing (IAST)?
IAST combines aspects of static and dynamic testing, analyzing applications from within during runtime to identify vulnerabilities with higher accuracy.
IASTinteractive testingruntime analysis
What is Software Composition Analysis (SCA)?
Software Composition Analysis identifies vulnerabilities and license issues in open source dependencies, helping teams manage the risks of third-party code.
SCAsoftware composition analysisdependency scanning
What is Static Application Security Testing (SAST)?
SAST analyzes source code to identify security vulnerabilities without executing the program, helping teams find issues early in development.
SASTstatic analysiscode scanning
What is the OWASP Top 10?
The OWASP Top 10 is a regularly updated list of the most critical web application security risks, serving as a standard awareness document for developers.
OWASPOWASP Top 10web security
Hooks & MCP
What Are Hooks in AI Coding?
Hooks are deterministic scripts that execute at specific points in the AI coding workflow, enabling security checks and policy enforcement that run every time.
hooksAI coding hookssecurity hooks
What is the Model Context Protocol (MCP)?
MCP is a protocol that allows AI coding agents to interact with external tools and services, enabling them to access databases, APIs, and security systems.
MCPModel Context ProtocolAI tools
How-To Guides
Secure Coding Practices for AI-Assisted Development
Best practices for writing secure code when working with AI coding agents, including review strategies, guardrails, and common pitfalls to watch for.
secure codingAI codingsecurity best practices
Setting Up Security Guardrails
Security guardrails are automated controls that prevent or flag potentially dangerous actions, keeping development moving while maintaining security standards.
security guardrailsautomated securitypolicy enforcement