{"slug": "show-hn-guide-ai-coding-agents-on-how-to-use-libraries-securely", "title": "Show HN: Guide AI coding agents on how to use libraries securely", "summary": "Reware Labs released AI Code Security Cards, an open-source security knowledge layer that provides version-specific security guidance for AI coding agents, developed from Hossein Hajipour's PhD research showing at least 40% of code generated by state-of-the-art models contains security issues. The cards, available on GitHub and via an integration page, aim to reduce vulnerabilities in AI-generated code by supplying library-specific security context.", "body_md": "Hi HN,\n\nAI coding agents can generate working code, but they often lack library- and version-specific security knowledge. We've developed AI Code Security Cards, an open-source security knowledge layer, to provide that missing context.\n\nThe project is related to my PhD, in which I focused on the security of LLM-generated code. During my research, I studied how code generation models behave, how they introduce security issues, and how we can guide them toward generating safer code.\n\nMy research [1] and several other studies [2–4] show that at least 40% of code generated by state-of-the-art models contains one or more security issues. Similar problems also affect AI coding agents.\n\nOne reason is that these models often lack sufficient library-specific security knowledge in their context. They may not know which configurations are unsafe, which validation steps are required, or what security-related behavior has changed between library versions.\n\nAI Code Security Cards provide practical, version-specific security guidance for open-source libraries. For example, the Django security cards can guide an AI agent on how to implement authentication and authorization securely.\n\nThe easiest way to use the cards is to install the AI skill provided in the repository (And in the integration page: [https://securitycards.rewarelabs.com/integration/](https://securitycards.rewarelabs.com/integration/)). You can also download them and add them directly to your AI agent’s rules or instructions.\n\nWe’d be glad to hear your feedback, especially on where these cards would be most useful in your workflow, which libraries we should support next, and whether you’ve encountered similar security issues caused by missing context.\n\nWebsite: [https://securitycards.rewarelabs.com/](https://securitycards.rewarelabs.com/)\nGitHub Repository: [https://github.com/Reware-Labs/securitycards](https://github.com/Reware-Labs/securitycards)\n\n*References*\n\n[1] Hajipour, Hossein, et al. “CodeLMSec Benchmark: Systematically Evaluating and Finding Security Vulnerabilities in Black-Box Code Language Models.” 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), IEEE, 2024, pp. 684–709. [https://doi.org/10.1109/SaTML59370.2024.00040](https://doi.org/10.1109/SaTML59370.2024.00040).\n\n[2] Pearce, Hammond, et al. “Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions.” Communications of the ACM, vol. 68, no. 2, 2025, pp. 96–105. [https://doi.org/10.1145/3610721](https://doi.org/10.1145/3610721).\n\n[3] Vero, Mark, et al. “BaxBench: Can LLMs Generate Correct and Secure Backends?” arXiv, 2025, [https://doi.org/10.48550/arXiv.2502.11844](https://doi.org/10.48550/arXiv.2502.11844).\n\n[4] von Arx, Tobias, et al. “AutoBaxBuilder: Bootstrapping Code Security Benchmarking.” arXiv, 2025, [https://doi.org/10.48550/arXiv.2512.21132](https://doi.org/10.48550/arXiv.2512.21132).\n\nComments URL: [https://news.ycombinator.com/item?id=49169280](https://news.ycombinator.com/item?id=49169280)\n\nPoints: 1\n\n# Comments: 0", "url": "https://wpnews.pro/news/show-hn-guide-ai-coding-agents-on-how-to-use-libraries-securely", "canonical_source": "https://github.com/Reware-Labs/securitycards", "published_at": "2026-08-04 14:12:10+00:00", "updated_at": "2026-08-04 14:23:49.517236+00:00", "lang": "en", "topics": ["ai-safety", "ai-research", "ai-tools", "ai-agents"], "entities": ["Reware Labs", "AI Code Security Cards", "Hossein Hajipour", "Django", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/show-hn-guide-ai-coding-agents-on-how-to-use-libraries-securely", "markdown": "https://wpnews.pro/news/show-hn-guide-ai-coding-agents-on-how-to-use-libraries-securely.md", "text": "https://wpnews.pro/news/show-hn-guide-ai-coding-agents-on-how-to-use-libraries-securely.txt", "jsonld": "https://wpnews.pro/news/show-hn-guide-ai-coding-agents-on-how-to-use-libraries-securely.jsonld"}}