Securing Artificial Intelligence (AI) Coding Assistants in the Software Development Lifecycle (SDLC)

IntermediateFree5 modules · 14 lessons · ~2 min

About this course

An AppSec course on the risks AI coding assistants such as Claude Code, Codex, Cursor and Copilot introduce into the software development lifecycle and the controls that contain them. You will build a threat model covering hallucinated packages, insecure generated code, secret leakage, injected instructions and over-privileged agents, then apply Safeguard's IDE extensions, Package Firewall, secrets scanning, PR Guard, gates, provenance, AI-BOM and agent identity at the desk, in the pipeline and on the assistants themselves. The course ends with metrics, a maturity model and incident playbooks.

What you'll learn

Threat Model of AI-Assisted Development

How Coding Assistants Actually Work: Context, Edits, Commands and Agent Loops
The Threat Catalogue: Hallucinated Packages, Insecure Patterns, Secret Leakage and Injected Instructions
Mapping to OWASP Top 10 for LLM Applications, SLSA and SSDF

Controls at the Developer's Desk

Security Insight as You Code: IDE Extensions and In-Editor Verdicts
Stopping Hallucinated and Malicious Packages at Install Time: OSM, Gold and the Package Firewall
Secrets Hygiene When an Assistant Reads Your Files

Controls in the Pipeline

Reviewing AI-Generated Diffs: PR Guard, SAST Dataflow and Reachability
Gates for AI-Generated Changes: Policies, Findings and Enforcement Points
Provenance, Signing and Attribution for Agent-Authored Commits

01Threat Model of AI-Assisted Development3 lessons

How Coding Assistants Actually Work: Context, Edits, Commands and Agent Loops
The Threat Catalogue: Hallucinated Packages, Insecure Patterns, Secret Leakage and Injected Instructions
Mapping to OWASP Top 10 for LLM Applications, SLSA and SSDF

02Controls at the Developer's Desk3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Governing the Assistants Themselves

Inventorying Assistants, Skills and MCP Servers Developers Use
Rules Files, Skills and MCP Configurations as Code
Data-Handling Policy: Zero AI, Bring-Your-Own-Model, Local Runner and Private Mode

Program Design

Metrics and a Maturity Model for AI-Assisted Development Security
Incident Playbooks: Hallucinated Dependency Shipped, Secret Leaked to an Assistant, Injected Instruction Executed

Security Insight as You Code: IDE Extensions and In-Editor Verdicts
Stopping Hallucinated and Malicious Packages at Install Time: OSM, Gold and the Package Firewall
Secrets Hygiene When an Assistant Reads Your Files

03Controls in the Pipeline3 lessons

Reviewing AI-Generated Diffs: PR Guard, SAST Dataflow and Reachability
Gates for AI-Generated Changes: Policies, Findings and Enforcement Points
Provenance, Signing and Attribution for Agent-Authored Commits

04Governing the Assistants Themselves3 lessons

Inventorying Assistants, Skills and MCP Servers Developers Use
Rules Files, Skills and MCP Configurations as Code
Data-Handling Policy: Zero AI, Bring-Your-Own-Model, Local Runner and Private Mode

05Program Design2 lessons

Metrics and a Maturity Model for AI-Assisted Development Security
Incident Playbooks: Hallucinated Dependency Shipped, Secret Leaked to an Assistant, Injected Instruction Executed2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.