Yariv Tal
We blame the bot when AI-generated code is vulnerable, but what if it is just using the dangerous APIs we left on the table?
This talk tests whether API design can steer AI coding agents toward safer code. The same agent builds the same Java/Spring task app twice: once in a normal environment, and once in a constrained one with secure-by-default scaffolding, deny-by-default settings, safer abstractions, and bans on risky APIs.
The app includes authentication, authorization, task ownership, file upload, SSRF-prone link previews, and simulated paid features. The prompts describe product behavior, not security advice, so the comparison focuses on environment design rather than better prompting.
Both projects are analyzed with CodeQL and manual review to compare SAST findings, authorization flaws, unsafe file handling, SSRF risks, abstraction bypasses, and cases where wrappers hide risk instead of reducing it.
Yariv Tal
Secure Coding Mentor
Yariv Tal is a senior developer, security researcher, and cofounder of Secure From Scratch, a venture dedicated to teaching developers secure coding from the very first line of code.
A summa cum laude graduate of the Technion, Yariv brings four decades of programming experience and years of university lecturing and bootcamp mentoring to the field of application security.
He lectures on secure coding in academia and the private sector, leads the OWASP-untrust project, and researches the intersection of AI and application security, with a focus on secure code generation, LLM evaluation, and secure-by-construction development.