Wiz Shares Security Rules for AI-Assisted Coding Tools
Summary
Wiz describes how security-focused rules files can guide AI coding assistants, reviews research on reducing vulnerabilities through prompting, and shares baseline rules for several languages, frameworks, and tools.
Key points
- The article says AI-generated code can contain vulnerabilities and that developers relying heavily on generated code may face additional security risks.
- It recommends shifting SAST, SCA, and secrets scanning into IDE workflows where possible, while retaining pull-request scanning and secure-by-default frameworks.
- Rules files can provide reusable, project- or organization-specific security guidance to AI coding assistants.
- Suggested rules-file practices include clear, concise, actionable instructions; tailoring rules to scope; breaking guidance into small rules; and keeping files under 500 lines.
- The article cites studies reporting that security-focused prompts reduced vulnerable code, including one prompt that highlighted common CWEs.
- Wiz says it open-sourced baseline rules for Python, JavaScript, Java, and .NET frameworks, with versions for several coding assistants.
Article Details
- Defense Focus
- Reduce vulnerabilities in AI-generated code by applying security guidance through rules files and integrating code-security checks into development workflows.
- Detection Methods
- Run static application security testing (SAST), software composition analysis (SCA), and secrets scanning on code.
- Shift scans into the IDE where possible and scan pull requests for vulnerabilities and secrets.
- Data Sources
- Source code in the IDE
- Pull request code
- Rule Types
- AI coding-assistant security rules files
- SAST
- SCA
- Secrets scanning
- Platforms
- IDE
- Pull request workflows
- Defensive Actions
- Create organization-specific security rules for AI coding assistants, using clear, concise, actionable, and atomic guidance tailored to the relevant scope.
- Keep rules files concise; the article recommends fewer than 500 lines.
- Use prompting guidance that explicitly asks for secure code and addresses common weaknesses.
- Adopt secure-by-default frameworks and libraries.
- Review and scan AI-generated code rather than treating it as secure by default.
Products
Aidercoding tools offer rules, ranging from GitHub Copilot Repository Custom Instructions or Codex AGENTS.md, Aider Conventions, Cline Custom Instructions, Claude CLAUDE.md, Cursor Rules, and Windsurf Rules.Claude CodeLarge Language Models (LLMs) are good at coding. This has powered emerging AI-assisted programming tools, ranging from GitHub Copilot to AI IDEs and IDE extensions like Claude Code, Cursor, Windsurf, Codeium, and Roo. Clinerules, ranging from GitHub Copilot Repository Custom Instructions or Codex AGENTS.md, Aider Conventions, Cline Custom Instructions, Claude CLAUDE.md, Cursor Rules, and Windsurf Rules.CodeiumLarge Language Models (LLMs) are good at coding. This has powered emerging AI-assisted programming tools, ranging from GitHub Copilot to AI IDEs and IDE extensions like Claude Code, Cursor, Windsurf, Codeium, and Roo. CodexMost popular AI coding tools offer rules, ranging from GitHub Copilot Repository Custom Instructions or Codex AGENTS.md, Aider Conventions, Cline Custom Instructions, Claude CLAUDE.md, Cursor Rules, and WindsurfCursorLarge Language Models (LLMs) are good at coding. This has powered emerging AI-assisted programming tools, ranging from GitHub Copilot to AI IDEs and IDE extensions like Claude Code, Cursor, Windsurf, Codeium, and Roo. GitHub CopilotLarge Language Models (LLMs) are good at coding. This has powered emerging AI-assisted programming tools, ranging from GitHub Copilot to AI IDEs and IDE extensions like Claude Code, Cursor, Windsurf, Codeium, and Roo. RooLarge Language Models (LLMs) are good at coding. This has powered emerging AI-assisted programming tools, ranging from GitHub Copilot to AI IDEs and IDE extensions like Claude Code, Cursor, Windsurf, Codeium, and Roo. WindsurfLarge Language Models (LLMs) are good at coding. This has powered emerging AI-assisted programming tools, ranging from GitHub Copilot to AI IDEs and IDE extensions like Claude Code, Cursor, Windsurf, Codeium, and Roo.