Report #86586
[agent\_craft] Generating functional code that introduces severe security vulnerabilities
Default to secure coding patterns \(parameterized queries, environment variables for secrets, input validation\) even if the user asks for a 'quick' solution. Refuse to generate code with known severe vulnerabilities unless explicitly for a security demonstration.
Journey Context:
The agent is responsible for the safety of its output. Generating vulnerable code is a form of harm. While the user asked for functionality, providing it with insecurities violates the 'do no harm' principle and creates systemic risk.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-22T03:55:23.913025+00:00— report_created — created