Jim Manico from Manicode Security

AI and AppSec Educator. Secure coding system prompts.

[Jim Manico from Manicode Security @manicode]

From my experience all software developers are now security engineers wether they know it, admit to it or do it. Your code is now the security of the org you work for. #GoldenAgeOfDefense

[Jim Manico from Manicode Security @manicode]

On advanced corporate jargon….

https://t.co/J5CS87YODP

[Jim Manico from Manicode Security @manicode]

😂 🤣 🤪

[UI/UX Savior @UiSavior]

🤩

[UI/UX Savior @UiSavior]

🤩

[Jim Manico from Manicode Security @manicode]

Your AI coding assistant ships insecure code by default. Missing auth, broken JWT checks, injection.

Manicode fixes that. Secure-coding prompts + skills for Copilot, Cursor & Claude Code. Meta's CyberSecEval benchmark: .NET +80% React +27%

[email protected] if interested :)

[Jim Manico from Manicode Security @manicode]

Your AI coding assistant ships insecure code by default. Missing auth, broken JWT checks, injection.

Manicode fixes that. Secure-coding prompts + skills for Copilot, Cursor & Claude Code. Meta's CyberSecEval benchmark: .NET +80% React +27%

[email protected] if interested :)

[Jim Manico from Manicode Security @manicode]

You’re right. The hype is gaslighting.

Most of what gets posted is theater. But the reason it looks like nothing useful gets produced is that 90% of people are pointing AI at huge vague tasks and getting slop.

Where I see it actually work is small, well-scoped, testable stuff with tight guardrails. Spec driven development.

A lot of the spec driven AI people I know are not on Twitter posting “magic solutions” to fix AI. They are getting work done and building product.

[Jim Manico from Manicode Security @manicode]

@0xBoku @bcherny @AnthropicAI I suggest that you bump up to 4.8 and request that your cyber access be accelerated.

https://t.co/aYKZTusHTZ

[Jim Manico from Manicode Security @manicode]

@sarahyang_00 @minchoi New GitHub issue: plan carefully to extract all my data from salesforce and build an agent version specific to my business

[Jim Manico from Manicode Security @manicode]

This is exactly what I author in my courseware and I’m grateful folks are listening. The MCP spec helps, and the work of the AISVS team which I’m on also helps. Some are really doing this work, in class, in standards and in practice. 🤙 I’m grateful for the folks I work with who care about this. You too!

[Florian Roth ⚡️ @cyb3rops]

#Meta #MetaAIFail

[Jim Manico from Manicode Security @manicode]

@IceSolst Sophos got a huge security report from Tavis on a Friday night, said thank you, and spent the weekend fixing it all.

After I saw it go down, all corporate response is second to that.

Fix your damn bugs. 🐞

[Jim Manico from Manicode Security @manicode]

And just to be more honest, the practical threat to symmetric crypto (AES-128) is contested and probably minimal, but Grovers math is solid.

[Jim Manico from Manicode Security @manicode]

Grovers algorithm is dead.

https://t.co/FM01d7ySha

#PQC

[Jim Manico from Manicode Security @manicode]

@enjojoyy Research loops, spec driven development runs.

If I spend waking hours building machine readable specifications for applications, I can let CC run all night.

[Jim Manico from Manicode Security @manicode]

@vasuman What does your CLAUDE.md look like?

[Jim Manico from Manicode Security @manicode]

I’ve noticed that Claude Code works brilliantly with well designed applications using modern frameworks, and problems really show up in messy multi-framework legacy garbage.

So a theory is, Claude is way better for new applications designed well. Codex is better for going after legacy messes where serious surgery is needed.

So for those doing spec driven development on modern frameworks? You’re experience is likely positive.

Those vibe coding legacy messes? You likely hate Claude.

I’m curious if this matches your experience!

[Jim Manico from Manicode Security @manicode]

@guneysol How complex is your CLAUDE.md?

[Jim Manico from Manicode Security @manicode]

I learned a great deal about crypto and key management from Dino. Keep a close eye on this guy.

[Dino A. Dai Zovi @dinodaizovi]

It's becoming increasingly important to understand the real security properties of cryptographic key storage. A related problem is secure provisioning of those cryptographic keys.

The shortcut is to just learn from established systems vs. slowly rediscovering the need for them.

[Jim Manico from Manicode Security @manicode]

I'm delivering a webinar on Claude Code (spec driven development) to help us all use Claude Code and other AI coding tools with quality, security and maturity.

This will land June 15 @ 10am PT. Hope to see you there. I love doing these and feel it's high value info for you!

https://t.co/KFPkAS5lj9