Skip to main content

Secure by default

The security posture every AI-built service inherits automatically — shipped as machine-readable rules and linter config in the project scaffold, so agents build to it rather than being audited afterwards. An OWASP ASVS L2 baseline made concrete for the chosen stack.

The defaults​

  • Authenticated by default — endpoints require auth unless explicitly, reviewably opted out.
  • Parameterised queries — no string-built SQL; enforced by lint.
  • Output encoding — context-correct encoding on all output; XSS defences on by default.
  • Hardened templates & headers — secure defaults for framework config, security headers, cookie flags.
  • Least privilege — services and credentials get the minimum access they need.
  • No secrets in code — secrets come from a vault; scanning blocks any leak (see below).

Why "by default" matters with agents​

An agent will follow the path of least resistance. If the scaffold's default is secure — the safe query builder, the authenticated route, the encoded output — the agent produces secure code without being told. If the default is insecure, no amount of review catches every lapse at volume. Security is designed into the starting point, not inspected in at the end.

Enforcement​

  • Secure-coding rules ship as linter config; violations fail the merge gate.
  • The posture is verified continuously by the security gates.
  • Standards referenced: OWASP ASVS (L2 target for insurance data).