Codeslick.dev

CodeSlick: AI Code Trust Guardian.
Combines AI detection with comprehensive security scanning to catch vulnerabilities before they reach production.

[Codeslick.dev @CodeslickDev]

The sneakiest supply chain attack.
The persistence hooks in .claude/, .cursor/rules/, and .vscode/tasks.json are particularly nasty, surviving clean reinstalls and keep coming back.
Read the blog post if you're working with AI tools or cloud-heavy stack: https://t.co/SQVpc9ffYS

[Codeslick.dev @CodeslickDev]

@snyksec dropped @claudeai into their platform. AI didn’t just make us faster. It killed the last reason to treat security as an afterthought. Here’s what developer-owned security looks like in 2026 →https://t.co/kmR63aZtSK

[Codeslick.dev @CodeslickDev]

Legacy code doesn’t fail when it’s running.
It fails the day someone has to change it. If you’re tired of “Don’t touch line 847”, you need Endure.
https://t.co/JJ8mOSeGHJ

[Codeslick.dev @CodeslickDev]

@snyksec dropped @claudeai into their platform. The excuse “security is someone else’s problem” is dead. AI didn’t just make us faster. It killed the last reason to treat security as an afterthought. Here’s what developer-owned security looks like in 2026: https://t.co/kmR63aZtSK

[Codeslick.dev @CodeslickDev]

CISA and NIST have been publishing the same six security controls for years.
Most developers treat them as compliance noise.
They are engineering problems.
CodeSlick blog post: https://t.co/r6wwktfT84

[Codeslick.dev @CodeslickDev]

Same mistake. 100x the velocity.

Human devs: one SQL injection if they’re tired.
AI: same SQL injection in every endpoint, with confidence.

jwt.decode() and pickle.loads() are the new classics.

AI didn’t fix our bad habits. It industrialized them.

https://t.co/l8OlDmm3PZ

[Codeslick.dev @CodeslickDev]

We got OWNED by Snyk… on our own product. We fixed it in one day.
Now we see the entire dependency tree. Raw story and details on LinkedIn https://t.co/QN65jcPCLl

#DevSecOps #Security

[Codeslick.dev @CodeslickDev]

The Vercel breach wasn’t about a leaked password.
It was about environment variables that no one thought needed protecting.
CodeSlick new post break down exactly why that distinction is dangerous & walk through the full attack chain that actually happened.
https://t.co/Xm99ElLz8a

[Codeslick.dev @CodeslickDev]

If you're using Supabase in production (especially with AI agents or RAG pipelines), the predictable UUID issue alone is worth checking — it affects session tokens and PKCE flows.
Full breakdown + fixes in CodeSlick blog post: https://t.co/RtDS6obBIz

[Codeslick.dev @CodeslickDev]

Just shipped something we’re genuinely proud of at CodeSlick.
Security Memory is now live.

It gives your AI coding agents the one thing they’ve always lacked: your repo’s actual security history — before they write a single line of code.
https://t.co/DIdxaYMH5M

[Codeslick.dev @CodeslickDev]

First thing I did when I saw the axios attack this morning was check our own lockfiles.
We were clean.
Sharing this from the CodeSlick, including how to scan your project in one command, no signup needed.
https://t.co/PmLWfJWY0w

[Codeslick.dev @CodeslickDev]

Policy-as-code isn't new as a concept.
Most implementations are either tied to a specific cloud provider or require a DSL nobody wants to learn. This is just YAML in your repo.
If your security rules aren't in Git, they don't exist.
How it works: https://t.co/ll6pn1ckUk

[Codeslick.dev @CodeslickDev]

New in this scan:
.CrewAI: 75 critical findings
.MCP TypeScript SDK: credentials in the SDK that builds MCP servers
.Google Gemini JS: 6.07 findings/file (highest density of 8)
Full data + raw scans: https://t.co/R52XWSKBkg

[Codeslick.dev @CodeslickDev]

We re-audited 8 major AI SDKs. 4,665 files. 260 critical findings.
The good news: all original repos improved.
vercel/ai: -65% critical. LangChain: -25%. openai-node: -50%.
The bad news: the same 3 failure modes are still in every single one.
Thread ...

[Codeslick.dev @CodeslickDev]

3 patterns that survive across all 8 repos:
.Hardcoded credentials in example code (copies into prod)
.Missing error handling in agent flows (silent failures = corrupted context)
.Unvalidated tool handler inputs (prompt injection precondition)

[Codeslick.dev @CodeslickDev]

We audited top AI agent frameworks:
.Command injection risks
.SQL injection patterns
.Unsafe handling of user input
.Over-trusting agent-generated actions

As AI accelerates development, security gaps scale with it.
Full audit and recommendations: https://t.co/KrdeGy4VxZ

[Codeslick.dev @CodeslickDev]

CodeSlick MCP Server: 6 Security Tools for Cursor and Claude Desktop:
analyze_code,
detect_secrets,
scan_dependencies,
generate_sbom,
generate_ai_bom,
check_security_policy

Full description: https://t.co/wkAwFOlHum

[Codeslick.dev @CodeslickDev]

We audited vercel/ai, LangChain, the OpenAI SDK, and the official MCP servers.
AI-generated code with hallucinated methods found in all four.
SQL injection in LangChain vector stores. SSRF in Tavily. AI-gen code in the Git MCP server.

Full reports: https://t.co/HT7PZG6U0R

[Codeslick.dev @CodeslickDev]

AI agents write production code. Legacy SAST was built for humans.
164 AI detection signals. Deterministic output. Breakability risk labels.
Q1 platform update — security infrastructure for agentic systems:
https://t.co/45R5VcogMh

[Codeslick.dev @CodeslickDev]

Anthropic launched code review tool. Impressive tech. But “Claude flagged a bug” isn’t audit evidence.
SOC2 need's traceable findings: CWE, CVSS, file, commit, timestamp.
We broke down what Claude Code Review does well — and where tools like CodeSlick fit.
https://t.co/OlW36l67vB