A running joke in the developer community is the idea of throwing your computer out the window when debugging seems endless. AI tools like Copilot, Cursor, Bolt, and Claude accelerate development workflows but introduce risks. They can also increase the things web developers tend to overlook, such as overlooking security best practices. AI-generated code frequently hallucinates or references nonexistent methods.
The fundamental challenge: developers must address non-happy paths—edge cases, scalability, and security—not just functional workflows. A real-world cautionary tale involves Leo, who posted on Twitter that his new SaaS platform was built using AI tools like Cursor and was made an example of by hackers.
Treat AI like junior developers. Establish explicit requirements and create guardrails early in development to prevent becoming the next tech meme on Reddit.
What "Shift Left on Security" Really Means
"Shifting left" means addressing issues during planning rather than late-stage development. The more we poke holes in what we think we're building, the less likely we are to have to make a huge and expensive pivot.
Three benefits emerge:
- Reduces far-right (late-stage) issues
- Empowers developers to own security
- Transforms feature-building into secure system design
Building a Security-First Mindset
There are three workflow phases to consider:
1. Define Problem, Create Design, Complete Discovery
Involve security teams early to identify major risks and discuss compliance, architecture, and threat models.
2. Security Checking
Transform this from a checkbox into collaborative exploration. Encourage red-team thinking: What could malicious users exploit? Could inputs be manipulated? How might someone gain unauthorized access?
3. Secure by Test
Translate threat discussions into automated test scenarios, covering input validation, data sanitization, authentication checks, and file upload restrictions.
Secure by Test: Automating Defenses
Common security-focused unit tests include:
- Input validation (expected data types/lengths)
- Data sanitization (injection attack prevention)
- Authentication/authorization verification
- File upload restrictions
- Rate limiting validation
- Edge case scenarios from past incidents
For example, if you're building a feature that grants free credits on first form submission, write tests validating backend usage limits, submission windows, and duplicate request rejection.
Logging to Alert the Right People
Effective security requires observable alerting systems:
- Create measurement-based threshold alerts
- Define escalation workflows (who gets notified, how, response protocols)
- Use platforms like Sentry with Slack/email notifications
Balance capturing meaningful security signals against alert fatigue.
Secure Code Is Product Quality
Security should always determine product quality. Even partial implementation supports junior developers and catches AI-generated vulnerabilities early, enabling faster, safer shipping.
Want help implementing security-first development practices? Book a discovery call to discuss how to shift left on security.
