GitLab
Follow
3 best practices for building software in the era of LLMs
AI is revolutionizing software development, with 81% of developers either using or planning to use it. This increased reliance on AI-generated code can lead to a decrease in manual scrutiny, potentially introducing security risks. Security professionals must guide developers to adopt AI tools safely, balancing speed with security.A zero-trust mindset is crucial, treating AI-generated code like that from a junior developer requiring thorough review. Developers who can explain AI-generated code and its safety will become indispensable. Tools like GitLab Duo Code Review enhance human judgment by identifying potential issues in AI-assisted code reviews.Prompt engineering is vital; clear, security-aware prompts yield more secure AI outputs. Including security best practices like input validation and rate limiting in prompts improves code quality. Training developers in secure prompt engineering is as important as teaching secure coding patterns.The proliferation of AI necessitates continuous, automated security scanning throughout the development process. SAST, SCA, and Secret Detection are essential for mitigating vulnerabilities and supply chain attacks. Accurate and scalable scanning is key to maintaining pace with AI-assisted development without generating false positives.Making scanning a non-negotiable part of every commit and branch is vital for security. GitLab embeds security directly into the developer workflow, offering native scanning and AI-powered insights. While AI is not a shortcut to security, the right practices and platforms can facilitate fast, secure, and scalable software development.