No One Talks Enough About Security for AI Coding. Here's How I Do It in My Workflows

YouTube · Watch/Read

• AI coding assistants frequently introduce security vulnerabilities, either directly or through insecure dependencies, and relying on another AI agent for review is insufficient due to its probabilistic nature.
• Cole advocates for “deterministic gates” in AI coding workflows, using his open-source harness builder Arkon to orchestrate the process and integrating SonarQube for guaranteed, automated vulnerability scanning against the massive CVE catalog.
• His workflow involves an Arkon-managed agent implementing code, followed by a mandatory SonarQube scan that acts as a gate; if vulnerabilities are detected, the agent is forced to iterate and fix them until the scan is “green” before a pull request is finalized, warning against merging code with unaddressed security issues.