Secure AI-Assisted
Development
Empowering
Developers,
Mitigating Risks
A practical guide to using AI code assistants safely 4 based on OpenSSF best
practices.
OPENSSF SECURITY GUIDE
The Promise of AI Code
Assistants
AI coding tools are transforming how software is built 4 but understanding their
potential is the first step to using them responsibly.
§ Faster Cycles í Complex Tasks
Accelerate development by Get intelligent assistance with
automating repetitive tasks and architecture decisions, algorithm
generating boilerplate code design, and unfamiliar
instantly. frameworks.
n Democratized Coding
Lower the barrier to entry, enabling more developers to contribute
effectively regardless of experience level.
CORE PRINCIPLE
You Are the Developer.
AI Is the Assistant.
AI-generated code requires critical evaluation and editing before it
becomes production-ready. The developer's judgment is irreplaceable.
Never blindly accept AI suggestions, You are ultimately responsible for Treat AI output as a first draft 4 not
especially in security-sensitive or the code's security, correctness, and a finished solution.
high-stakes contexts. real-world impact.
The Hidden Risks: AI Can Introduce Vulnerabilities
AI assistants are trained on vast codebases — including insecure patterns. Without guidance, they may suggest harmful code.
Outdated Cryptography Missing Error Handling
May recommend deprecated algorithms or weak encryption Often omits critical try/catch blocks, input validation, and edge-
standards no longer considered safe. case handling.
Secret Leaks Vulnerable Dependencies
Can inadvertently suggest hardcoding API keys, passwords, or May recommend packages with known CVEs or outdated
tokens directly in source code. versions with security flaws.
Guiding the AI: The Power of
Custom Instructions
Custom instructions act as a security conscience for your AI assistant 4 shaping
its outputs before a single line of code is generated.
Concise, Specific & Actionable
Clear, focused instructions influence AI behavior without overwhelming it.
Specificity drives better, safer outputs.
Embed a Security Conscience
Instruct the AI to always consider application security, supply chain safety,
and platform-specific requirements in every response.
Supported Formats
Claude (markdown), GitHub Copilot (instructions file), Cline (instructions
file) 4 each platform supports custom guidance.
Key Principles for Secure AI Instructions
Build Security Into Every Prompt
These three principles form the foundation of responsible AI-
assisted development. Apply them consistently to ensure every AI-
generated suggestion meets your security standards before it
touches your codebase.
Treat AI like an intern: capable, but always requiring
supervision and review.
Recursive Criticism & Improvement (RCI)
One of the most powerful techniques: ask the AI to critique and improve its own output before you accept it.
Review Revise Repeat
Each iteration surfaces hidden issues and progressively strengthens the code — turning a single AI response into a refined, security-reviewed
output.
From Vulnerability to Verified Security
❌ Before: Unreviewed AI Code ✅ After: Security-Reviewed Code
Hardcoded credentials and secrets Secrets managed via environment variables
Deprecated cryptographic functions Modern, approved cryptographic standards
Missing input validation Comprehensive input validation and sanitization
Known vulnerable package versions Pinned, vetted dependency versions
No error handling or logging Full error handling with secure logging
Applying custom instructions + RCI transforms risky AI
output into production-ready, secure code.
The OpenSSF's Role: Building
a Secure AI Ecosystem
The Open Source Security Foundation (OpenSSF) leads the industry in creating
practical, community-driven guidance for secure software development.
Best Practices Working Group
Provides essential, vetted guidance for developers navigating AI-assisted
workflows safely.
Security-Focused Guide
The "Security-Focused Guide for AI Code Assistant Instructions" offers
actionable, platform-specific strategies you can implement today.
Industry Collaboration
The entire industry is learning together 4 sharing patterns, failures, and
successes to raise the security baseline for everyone.
The Future of Secure AI-Assisted Development
AI is not replacing developers — it's amplifying them. The teams that thrive will be those who pair AI's speed with human security expertise.
Contribute to the
Prioritize Security by Default Community
Embrace AI as a Partner Use clear custom instructions, enforce Share what you learn. Contribute to
Leverage AI as a powerful assistant, not code reviews, run SAST tools, and never OpenSSF resources. The collective
a replacement for human judgment, skip validation — even when AI says it's knowledge of the community is our
expertise, and accountability. fine. strongest defense.
Explore the full guide: OpenSSF Security-Focused Guide for AI Code Assistant Instructions