Hi HN,
AI coding agents can generate working code, but they often lack library- and version-specific security knowledge. We've developed AI Code Security Cards, an open-source security knowledge layer, to provide that missing context.
The project is related to my PhD, in which I focused on the security of LLM-generated code. During my research, I studied how code generation models behave, how they introduce security issues, and how we can guide them toward generating safer code.
My research [1] and several other studies [2–4] show that at least 40% of code generated by state-of-the-art models contains one or more security issues. Similar problems also affect AI coding agents.
One reason is that these models often lack sufficient library-specific security knowledge in their context. They may not know which configurations are unsafe, which validation steps are required, or what security-related behavior has changed between library versions.
AI Code Security Cards provide practical, version-specific security guidance for open-source libraries. For example, the Django security cards can guide an AI agent on how to implement authentication and authorization securely.
The easiest way to use the cards is to install the AI skill provided in the repository (And in the integration page: https://securitycards.rewarelabs.com/integration/). You can also download them and add them directly to your AI agent’s rules or instructions.
We’d be glad to hear your feedback, especially on where these cards would be most useful in your workflow, which libraries we should support next, and whether you’ve encountered similar security issues caused by missing context.
Website: [https://securitycards.rewarelabs.com/](https://securitycards.rewarelabs.com/)
GitHub Repository: [https://github.com/Reware-Labs/securitycards](https://github.com/Reware-Labs/securitycards)
References
[1] Hajipour, Hossein, et al. “CodeLMSec Benchmark: Systematically Evaluating and Finding Security Vulnerabilities in Black-Box Code Language Models.” 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), IEEE, 2024, pp. 684–709. https://doi.org/10.1109/SaTML59370.2024.00040.
[2] Pearce, Hammond, et al. “Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions.” Communications of the ACM, vol. 68, no. 2, 2025, pp. 96–105. https://doi.org/10.1145/3610721.
[3] Vero, Mark, et al. “BaxBench: Can LLMs Generate Correct and Secure Backends?” arXiv, 2025, https://doi.org/10.48550/arXiv.2502.11844.
[4] von Arx, Tobias, et al. “AutoBaxBuilder: Bootstrapping Code Security Benchmarking.” arXiv, 2025, https://doi.org/10.48550/arXiv.2512.21132.
Comments URL: [https://news.ycombinator.com/item?id=49169280](https://news.ycombinator.com/item?id=49169280)
Points: 1