Your app works. Every feature does what you asked, so it feels finished. But working and safe are two different things, and your agent only ever aimed for the first.
This part gets your app safe, and you do not have to become a security expert to do it. You have to know what you are protecting, and make your AI lock each piece down.
11.1.1AI writes working code, not safe code
Ask your agent for a login and you get a working login. You did not ask it to stop someone from skipping that login, reading another user's data, or pasting in something that breaks your database. Nothing guarantees it did any of that.
The agent optimizes for the goal you can see: the feature works. Safety is the goal you cannot see until it fails, so unless you name it, it gets skipped.
11.1.2Security is the requirement nobody asks for
A broken feature shows itself the moment you click. A security hole shows nothing. It sits quiet and working until the day someone finds it, and by then the damage is done.
That is why security has to be a deliberate step, not something you hope the agent included. You name the requirement out loud, the same way you named what the app should do.
11.1.3You don't need to be an expert
This is not a hacking course, and you will not be writing cryptography. You need one thing the agent does not have on its own: the judgment to say "protect this."
Once you point at a risk, the agent is genuinely good at applying the known, standard defense for it. Your job is knowing what to point at. The rest of this part hands you that list.
11.1.4Name what you're protecting
Almost every risk lands on one of four things. Name them, and you know what to hand your agent:
The next chapters take these in turn: locking the doors with real auth, guarding your surfaces against the common attacks, and running a full audit before you launch. Start by having your agent map the risks for your specific app:
Do this now: paste the prompt, get your app's plain-language risk map, and keep it open as you work through the rest of this part.
