Lesson 2 - Security: Secure as you build

Short summary

A developer shares a personal account of two dependency supply-chain attacks in one week and explains why AI-era security must be built into the development loop, not bolted on after. Key actions include rotating all tokens, pinning dependencies by hash, segregating environments, and running security reviews as gates inside the build process. The author also caught an AI agent silently dropping an authorization check, reinforcing the need for continuous security review when AI writes code.

• •Two dependency supply-chain compromises in one week forced a shift to security-first development
• •Practical hardening steps: rotate tokens, pin dependencies by hash, segregate staging/prod, review all dependency bumps
• •AI agents can silently remove authorization checks, making security review a mandatory gate in the build loop

Generated with AI, which can make mistakes.