<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
  xmlns:dc="http://purl.org/dc/elements/1.1/"
  xmlns:content="http://purl.org/rss/1.0/modules/content/"
  xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>VibeSec Advisory Blog</title>
    <link>https://vibesecadvisory.com/blog/</link>
    <description>FORGE Methodology insights, security guardrails, and governance guidance for knowledge worker teams. The FORGE framework (Skills, Agents, Guardrails, Schedule) for redesigning processes with agentic AI. By Ryan Macomber at VibeSec Advisory.</description>
    <language>en-us</language>
    <lastBuildDate>Sat, 16 May 2026 00:00:00 GMT</lastBuildDate>
    <atom:link href="https://vibesecadvisory.com/feed.xml" rel="self" type="application/rss+xml" />
    <image>
      <url>https://vibesecadvisory.com/favicon-32x32.png</url>
      <title>VibeSec Advisory Blog</title>
      <link>https://vibesecadvisory.com/blog/</link>
    </image>
    <item>
      <title>Map AI Data Boundaries Before You Write Another AI Policy</title>
      <link>https://vibesecadvisory.com/blog/map-ai-data-boundaries-before-ai-policy/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/map-ai-data-boundaries-before-ai-policy/</guid>
      <pubDate>Sat, 16 May 2026 00:00:00 GMT</pubDate>
      <category>AI Governance</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[AI governance starts getting useful when teams map what data can enter each AI workflow, what stays out, and where humans approve the result.]]></description>
      <content:encoded><![CDATA[Most AI policy fails because nobody mapped the data first.

A policy can tell employees not to paste sensitive information into AI tools. That helps. It does not answer the daily workflow questions that actually decide whether people follow the rule.

Can support summarize a customer ticket with AI?

Can sales ask AI to draft a renewal email using CRM notes?

Can finance use AI to classify invoices?

Can an internal agent search a shared drive?

Those are not abstract governance questions. They ]]></content:encoded>
    </item>
    <item>
      <title>Your AI Agent Needs a Tool Inventory Before It Needs More Policy</title>
      <link>https://vibesecadvisory.com/blog/ai-agent-tool-inventory/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/ai-agent-tool-inventory/</guid>
      <pubDate>Fri, 15 May 2026 00:00:00 GMT</pubDate>
      <category>AI Governance</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Before an AI agent touches files, APIs, databases, or customer systems, map the tools it can call and the decisions humans must approve.]]></description>
      <content:encoded><![CDATA[Most AI agent risk hides in the tools, not the chat box.

A model with no tools can still produce bad advice. A model with file access, database access, ticket access, email access, or API access can turn bad instructions into real action.

That is the line teams keep missing.

Short answer

An AI agent tool inventory is a simple list of every tool an AI system can call, what data each tool can touch, what action it can take, who approves risky use, and what logs exist afterward. It helps teams ]]></content:encoded>
    </item>
    <item>
      <title>AI Rewards People Who Learn by Doing</title>
      <link>https://vibesecadvisory.com/blog/ai-learning-by-doing-self-efficacy/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/ai-learning-by-doing-self-efficacy/</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <category>AI Strategy</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[AI does not replace learning. It tightens the feedback loop for people who believe they can figure things out and stay engaged with the work.]]></description>
      <content:encoded><![CDATA[The short version

AI rewards people who are willing to get lost.

That is the part I could not explain cleanly until I started reading the research.

I learned more in the past year by stumbling into new technologies during real projects than I did by watching clean tutorials. The mess was the point.

AI did not make the learning easy. It made the loop tighter.

I could try something, hit a wall, ask why it broke, get a new path, test it, then compare the answer against what actually happened. ]]></content:encoded>
    </item>
    <item>
      <title>Secure Your AI Coding Assistant in 5 Minutes</title>
      <link>https://vibesecadvisory.com/blog/secure-your-ai-coding-assistant/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/secure-your-ai-coding-assistant/</guid>
      <pubDate>Sun, 26 Apr 2026 00:00:00 GMT</pubDate>
      <category>FORGE Methodology</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Claude Code, Cursor, Copilot — whatever you use, it probably has no security guardrails configured. This prompt generates a role-specific CLAUDE.md with secret detection, file access boundaries, and approval gates in under five minutes.]]></description>
      <content:encoded><![CDATA[Your AI coding assistant has no guardrails

Open your CLAUDE.md file right now. Or your .cursorrules. Or your Copilot agent configuration. What does it say about security?

For most people, the answer is nothing. Or worse — there is no configuration file at all. The AI agent runs with whatever defaults the tool shipped with, which typically means: access everything, modify anything, ask about nothing.

This is the equivalent of giving a new contractor the admin password on their first day and te]]></content:encoded>
    </item>
    <item>
      <title>The Best AI Course Right Now Is Your Own Workflow</title>
      <link>https://vibesecadvisory.com/blog/learn-ai-by-doing/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/learn-ai-by-doing/</guid>
      <pubDate>Fri, 24 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Strategy</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[People ask me where I learned AI and which course they should take. I tell them the truth. Courses go stale in a week. You learn AI by using it, breaking it, and asking better questions until something clicks.]]></description>
      <content:encoded><![CDATA[The short answer: how to actually learn AI in 2026

The best way to learn AI in 2026 is to stop collecting courses and start running reps on your own work. AI courses go stale within a week or two because models and products update faster than any curriculum can keep up. The learning loop that actually compounds is simple.

1. Stay inside the products you want to learn, daily, and click on features you have never opened.
2. Follow one or two sharp creators when real launches happen, not ten loud]]></content:encoded>
    </item>
    <item>
      <title>Security Headers Every Web App Needs: A Complete Implementation Guide</title>
      <link>https://vibesecadvisory.com/blog/security-headers-every-web-app-needs/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/security-headers-every-web-app-needs/</guid>
      <pubDate>Thu, 23 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Strategy</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Security headers are the easiest high-impact security improvement you can make. This guide covers every header that matters, what it does, how to implement it on any platform, and common mistakes to avoid.]]></description>
      <content:encoded><![CDATA[The easiest security win you are not using

HTTP security headers are instructions your server sends to the browser that control how your content is handled. They block clickjacking, prevent XSS exploitation, stop MIME-type confusion attacks, and enforce encrypted connections. They are a defense layer that works even when your application code has vulnerabilities.

Adding security headers takes 15-30 minutes. The protection they provide is disproportionately high for the effort involved. Yet mos]]></content:encoded>
    </item>
    <item>
      <title>Why Scanners Miss What Humans Catch</title>
      <link>https://vibesecadvisory.com/blog/why-scanners-miss-what-humans-catch/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/why-scanners-miss-what-humans-catch/</guid>
      <pubDate>Tue, 21 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Automated security scanners are useful, but they miss the vulnerabilities that actually get exploited. Here is what scanners cannot find and why human security review still matters.]]></description>
      <content:encoded><![CDATA[The security scanner promise

The pitch is compelling: run a tool against your application, get a list of vulnerabilities, fix them, and you are secure. Tools like Snyk, CodeQL, Burp Suite, and dozens of others offer automated security scanning that can analyze your code or probe your running application for known vulnerability patterns.

These tools are genuinely useful. They catch real issues. You should use them.

But they have fundamental limitations that are important to understand, especia]]></content:encoded>
    </item>
    <item>
      <title>AI Agent Guardrails Audit: Find What Your AI Can Do That It Shouldn&apos;t</title>
      <link>https://vibesecadvisory.com/blog/ai-agent-guardrails-audit/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/ai-agent-guardrails-audit/</guid>
      <pubDate>Sun, 19 Apr 2026 00:00:00 GMT</pubDate>
      <category>FORGE Methodology</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Your AI coding agent can probably read your environment variables, access your credentials, and push code to production. This Claude Code prompt scans your local setup and tells you exactly what is exposed — and what to lock down first.]]></description>
      <content:encoded><![CDATA[You probably have no idea what your AI agent can access

Here is a question most teams have never asked: what can our AI coding agents actually see?

Not what they are supposed to see. What they can see. Right now. On your machine, with your configuration, with every MCP server you have connected and every environment variable you have set.

I run this audit on every FORGE consulting engagement. The reaction is always the same. People are surprised. Not because the tools are doing anything malic]]></content:encoded>
    </item>
    <item>
      <title>The VibeSec Security Checklist: The Complete Guide to Securing AI-Generated Code</title>
      <link>https://vibesecadvisory.com/blog/vibe-coding-security-checklist/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/vibe-coding-security-checklist/</guid>
      <pubDate>Thu, 16 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Strategy</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[The comprehensive security checklist for anyone building with AI coding tools. Covers 50+ security items across authentication, API security, data protection, deployment, and monitoring. Bookmark this and use it before every launch.]]></description>
      <content:encoded><![CDATA[Why this checklist exists

Every week, we review applications built with Cursor, Claude Code, Bolt, Lovable, and other AI coding tools. The same vulnerabilities appear over and over. Not because developers are careless, but because AI coding tools consistently skip security patterns that do not directly contribute to making features work.

This checklist is compiled from hundreds of real security assessments. It covers every category of vulnerability we commonly find in AI-generated applications]]></content:encoded>
    </item>
    <item>
      <title>How to Secure a Cursor-Built App: A Step-by-Step Guide</title>
      <link>https://vibesecadvisory.com/blog/how-to-secure-cursor-built-app/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/how-to-secure-cursor-built-app/</guid>
      <pubDate>Tue, 14 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Strategy</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[You built your app with Cursor and it works great. Now here is how to make sure it is actually secure before you put real users on it. A practical, step-by-step security hardening guide.]]></description>
      <content:encoded><![CDATA[You shipped fast. Now ship safe.

Cursor is one of the most powerful AI coding tools available. It understands your codebase, writes code that works, and lets you build features at a pace that would have been impossible two years ago. If you are reading this, you have probably already used it to build something real.

The problem is that Cursor, like all AI coding tools, optimizes for functionality. It makes your app work. But working and secure are not the same thing, and the gap between them i]]></content:encoded>
    </item>
    <item>
      <title>Map Any Business Process for AI in 10 Minutes</title>
      <link>https://vibesecadvisory.com/blog/map-any-business-process-for-ai/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/map-any-business-process-for-ai/</guid>
      <pubDate>Sat, 11 Apr 2026 00:00:00 GMT</pubDate>
      <category>FORGE Methodology</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Most teams automate random tasks instead of thinking systematically about their processes. This Claude Code prompt walks you through decomposing one workflow into the pieces an AI agent can actually take over — and the pieces it should not.]]></description>
      <content:encoded><![CDATA[The problem with how teams adopt AI

Everyone is automating the wrong things.

A sales team uses Claude to draft emails. A marketing team uses it to summarize meeting notes. An onboarding team uses it to format checklists. Each of these is a single task inside a larger process that nobody has looked at as a whole.

The result is what I call tool-assisted busy work. You are doing the same process you always did, just slightly faster in a few spots. Three months later, leadership asks what changed]]></content:encoded>
    </item>
    <item>
      <title>The 90-Day AI Plateau: Why Your Team Has the Tools and Nothing Changed</title>
      <link>https://vibesecadvisory.com/blog/the-90-day-plateau/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/the-90-day-plateau/</guid>
      <pubDate>Sun, 05 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Strategy</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Your team adopted AI tools three months ago. Usage is up. Results are flat. The problem is not the tools. You automated tasks inside a process designed for humans doing everything manually. Here is what actually works.]]></description>
      <content:encoded><![CDATA[You already know this feeling

Your team adopted AI tools three months ago. Maybe it was Copilot, maybe Claude, maybe something your sales team found on their own. The demo was impressive. The early adopters are loving it. Usage metrics look healthy.

But when leadership asks what actually changed, you do not have a good answer. Revenue is flat. Cycle times are the same. The team is "using AI" but the business is not measurably different.

You are at the 90-day plateau. Almost every team that ad]]></content:encoded>
    </item>
    <item>
      <title>AI Models Are Getting Better at Finding Bugs. That Does Not Replace Security Expertise.</title>
      <link>https://vibesecadvisory.com/blog/ai-models-getting-better-security-still-needs-humans/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/ai-models-getting-better-security-still-needs-humans/</guid>
      <pubDate>Sat, 04 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Frontier AI models are getting better at finding vulnerabilities. Some can now catch zero-days in mature codebases. Here is why that makes human security expertise more important, not less.]]></description>
      <content:encoded><![CDATA[The models are getting scary good

Every few months, a new AI model drops that makes the previous generation look like a calculator. Models that once struggled with basic code review can now trace execution paths across entire codebases, identify race conditions, and flag logic flaws that experienced security engineers might miss on a first pass.

The trajectory is clear. Within 12 months, the best AI models will be able to find vulnerabilities in codebases that have been considered "secure" for]]></content:encoded>
    </item>
    <item>
      <title>Amp Security Deep Dive: The Coding Agent That Redacts Your Secrets</title>
      <link>https://vibesecadvisory.com/blog/amp-security-deep-dive/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/amp-security-deep-dive/</guid>
      <pubDate>Sat, 04 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Amp is the only major AI coding agent with built-in secret redaction. It also sends your code to seven different AI providers. Here is what you need to know before using it.]]></description>
      <content:encoded><![CDATA[Amp does something no other coding agent does

Amp is the only major AI coding agent that automatically redacts your secrets before they reach an AI model.

Type your AWS access key into a file. Amp catches it. Paste a Stripe secret key. Amp replaces it with [REDACTED:stripe-api-key] before the model ever sees it. GitHub tokens, SendGrid keys, database passwords. All caught at the system level, before transmission.

No other coding agent does this by default. Not Claude Code. Not Cursor. Not Win]]></content:encoded>
    </item>
    <item>
      <title>Claude Code Can Build Your Entire Site. Here&apos;s What That Means for Security.</title>
      <link>https://vibesecadvisory.com/blog/cowork-claude-code-security-deep-dive/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/cowork-claude-code-security-deep-dive/</guid>
      <pubDate>Sat, 04 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Most people think Claude is a chatbot. It is also an autonomous coding agent that can build, deploy, and maintain a website with no code written by hand. Here is what that means for security.]]></description>
      <content:encoded><![CDATA[I went from prompt to published site in under an hour

I described what I wanted. Brand guidelines, design system, content structure. Claude built the site, connected to Vercel through its official plugin, and deployed. Live URL, branded, functional. No code written by hand. Under an hour.

Then I set up a scheduled task that fetches fresh content daily, commits it to the repo, and Vercel auto-deploys. The site updates itself every morning without me touching it.

This was not a prototype I thre]]></content:encoded>
    </item>
    <item>
      <title>What I Learned Talking to Hundreds of Enterprises About AI</title>
      <link>https://vibesecadvisory.com/blog/what-enterprises-get-wrong-about-ai-adoption/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/what-enterprises-get-wrong-about-ai-adoption/</guid>
      <pubDate>Sat, 04 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Strategy</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[I spent years as a sales engineer helping enterprises adopt AI tools. The same mistakes showed up in almost every conversation. Here are the patterns that keep companies stuck, and how FORGE Methodology gives you a framework to break them.]]></description>
      <content:encoded><![CDATA[I had the same conversation hundreds of times

Before I started VibeSec Advisory, I spent years as a sales engineer helping enterprises adopt AI tools. I talked to CTOs, VPs of Engineering, product leaders, and security teams at companies ranging from 50-person startups to Fortune 500 organizations.

The conversations were remarkably similar. The same concerns. The same mistakes. The same patterns of companies that moved fast and companies that got stuck. After a while, I could predict within th]]></content:encoded>
    </item>
    <item>
      <title>What Is the FORGE Methodology? From Tools to Arsenal</title>
      <link>https://vibesecadvisory.com/blog/what-is-the-forge-methodology/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/what-is-the-forge-methodology/</guid>
      <pubDate>Sat, 04 Apr 2026 00:00:00 GMT</pubDate>
      <category>FORGE Methodology</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Everyone has AI tools. Almost no one has a methodology for using them. FORGE is a six-pillar framework for redesigning knowledge work around autonomous AI agents — and building an arsenal that compounds.]]></description>
      <content:encoded><![CDATA[Why most AI adoption is failing quietly

Teams are buying AI tools. Usage numbers look great. Then, three months in, leadership asks what actually changed, and the answer is usually: not much.

People are using Claude to summarize emails. They are using Copilot to autocomplete code. They are prompting their way through tasks they could do without it. The tools are getting used. The processes have not changed at all.

This is the Solow paradox for knowledge workers: you can see the AI tools every]]></content:encoded>
    </item>
    <item>
      <title>I Built a Site With Manus in 20 Minutes. Here&apos;s What It Forgot.</title>
      <link>https://vibesecadvisory.com/blog/manus-site-security-what-it-forgets/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/manus-site-security-what-it-forgets/</guid>
      <pubDate>Fri, 03 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Manus is one of the fastest ways to go from idea to live website. But when I scanned the site it built me, it scored an F on security headers. Every AI website builder has this problem.]]></description>
      <content:encoded><![CDATA[I built a website in 20 minutes

Manus is impressive. I described what I wanted. It researched, designed, coded, and deployed a working website with branding, content, and a live URL. All from a single conversation. No code written by hand. No templates. No CSS tweaking.

For getting an idea off the ground fast, it is one of the best tools available right now. It hit $100 million in annual recurring revenue in eight months. Meta reportedly acquired it for $2-4 billion in late 2025. The hype is r]]></content:encoded>
    </item>
    <item>
      <title>Is AI-Generated Code Secure? What the Research Says</title>
      <link>https://vibesecadvisory.com/blog/is-ai-generated-code-secure/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/is-ai-generated-code-secure/</guid>
      <pubDate>Thu, 02 Apr 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Researchers have been studying whether AI coding assistants produce secure code. The short answer: no, not by default. Here is what the data shows and what you can do about it.]]></description>
      <content:encoded><![CDATA[The question everyone should be asking

AI coding assistants are writing a significant portion of the code being deployed to production today. GitHub reports that Copilot generates over 40% of code in files where it is active. Cursor, Claude Code, Bolt, and similar tools are being used to build entire applications from scratch.

The productivity gains are real. But a critical question is being overlooked: is the code these tools generate actually secure?

Researchers have been studying this ques]]></content:encoded>
    </item>
    <item>
      <title>MCP Tool Poisoning: How AI Coding Assistants Get Hijacked Through the Tools You Install</title>
      <link>https://vibesecadvisory.com/blog/mcp-tool-poisoning/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/mcp-tool-poisoning/</guid>
      <pubDate>Sat, 28 Mar 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[We tested 6 MCP attack scenarios against AI coding assistants. All 6 were fully exploitable. Here's what we found and how to protect yourself.]]></description>
      <content:encoded><![CDATA[You open Cursor. You ask your AI assistant to search the web, run a database query, or pull in some context from an external API. It calls an MCP tool. The tool returns a result. Your AI reads it and keeps working.

This is the workflow that makes modern AI-assisted development so fast. And right now, it has a serious security problem that almost nobody is talking about.

We ran a controlled security evaluation of MCP (Model Context Protocol) servers used in typical AI development workflows. We ]]></content:encoded>
    </item>
    <item>
      <title>Why Not Just Use an Automated Scanner?</title>
      <link>https://vibesecadvisory.com/blog/why-not-automated-scanner/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/why-not-automated-scanner/</guid>
      <pubDate>Fri, 27 Mar 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Automated scanners find known vulnerabilities fast. But they miss business logic flaws, context-dependent issues, and the AI-specific security gaps that matter most in AI-built applications.]]></description>
      <content:encoded><![CDATA[The appeal of automated scanners

Automated security scanners are fast, consistent, and relatively affordable. Tools like Snyk, Intruder, Detectify, Qualys, Acunetix, and Nessus can scan your application in minutes and produce a report with a list of findings.

For many teams, this sounds like enough. Why pay for a human assessment when a tool can do it automatically?

The answer is simple: automated scanners and human assessments answer different questions. Scanners ask "does this app have know]]></content:encoded>
    </item>
    <item>
      <title>The 6-Month Gap: Why AI Misses New Vulnerabilities</title>
      <link>https://vibesecadvisory.com/blog/six-month-gap/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/six-month-gap/</guid>
      <pubDate>Thu, 26 Mar 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Your AI coding assistant was trained 6 months ago. New CVEs come out every day. That gap is where attackers live.]]></description>
      <content:encoded><![CDATA[The problem

Your AI coding assistant was trained on data that is already old.

Claude Opus 4.6 training cutoff: Late 2025
OpenAI Codex 5.4 training cutoff: Early 2026
New critical CVEs: Every week

There is a gap between what the model knows and what is actually dangerous today. Attackers love this gap.

Why it matters

Say a new CVE drops next Tuesday. Remote code execution in a popular npm package.

Your AI assistant does not know about it. It will still happily import that package when you a]]></content:encoded>
    </item>
    <item>
      <title>Your AI Coding Partner Is Confidently Wrong About Security</title>
      <link>https://vibesecadvisory.com/blog/ai-wrong-about-security/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/ai-wrong-about-security/</guid>
      <pubDate>Thu, 19 Mar 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[We tested 3 AI assistants on security headers. All 3 gave us instructions. All 3 were wrong in different ways.]]></description>
      <content:encoded><![CDATA[The reality

We ran a test. We asked 3 popular AI coding assistants to add security headers to a website.

All 3 gave us instructions. All 3 were wrong in different ways.

What went wrong

Assistant A told us to add headers in Cloudflare Transform Rules. The option it described does not exist in the dashboard anymore.

Assistant B gave us a _headers file with syntax that Cloudflare Pages ignores. It mixed up Netlify and Cloudflare syntax.

Assistant C suggested a Content-Security-Policy with uns]]></content:encoded>
    </item>
    <item>
      <title>AI Wrote Your Code. Now Secure It.</title>
      <link>https://vibesecadvisory.com/blog/ai-wrote-your-code/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/ai-wrote-your-code/</guid>
      <pubDate>Thu, 19 Mar 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[You used Cursor, Claude Code, or Bolt to build your app. It works. You shipped fast. But AI coding tools optimize for functionality, not security.]]></description>
      <content:encoded><![CDATA[The situation

You used Cursor, Claude Code, or Bolt to build your app. It works. You shipped fast.

But AI coding tools optimize for functionality, not security. They will happily generate code with XSS vulnerabilities, missing auth checks, and exposed APIs.

Why it matters

AI-built applications are becoming prime targets because:

- They often skip security reviews in favor of speed
- Generated code may include deprecated or vulnerable patterns
- AI tools do not know your business logic or se]]></content:encoded>
    </item>
    <item>
      <title>The 30-Second CSP Check</title>
      <link>https://vibesecadvisory.com/blog/csp-quick-check/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/csp-quick-check/</guid>
      <pubDate>Thu, 19 Mar 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Run this in your terminal and find out if your Content-Security-Policy is actually protecting you.]]></description>
      <content:encoded><![CDATA[Quick test

Run this in your terminal:

``bash
curl -I https://yoursite.com | grep -i "content-security-policy"
`

What you want to see

`
content-security-policy: default-src 'self'; ...
`

What you do not want to see

Nothing at all

This means you have no CSP. Any script can run on your site.

unsafe-inline

This weakens your CSP. Attackers can inject inline scripts.

unsafe-eval

This allows eval() calls. Rarely needed and dangerous.

Asterisks

script-src * means scripts from anywhere. Not ]]></content:encoded>
    </item>
    <item>
      <title>Why Your Website Needs X-Frame-Options</title>
      <link>https://vibesecadvisory.com/blog/x-frame-options/</link>
      <guid isPermaLink="true">https://vibesecadvisory.com/blog/x-frame-options/</guid>
      <pubDate>Thu, 19 Mar 2026 00:00:00 GMT</pubDate>
      <category>AI Security</category>
      <dc:creator>Ryan Macomber</dc:creator>
      <description><![CDATA[Clickjacking is one of the oldest tricks in the book. And it still works on thousands of websites.]]></description>
      <content:encoded><![CDATA[The big picture

Clickjacking is one of the oldest tricks in the book. And it still works on thousands of websites.

Your site can be loaded inside an invisible iframe on a malicious page. Users think they are clicking one thing, but they are actually clicking your site.

Why it matters

Attackers use this to:

- Trick users into clicking ads they did not intend to click
- Get users to authorize OAuth applications they did not mean to authorize
- Steal credentials through fake login forms overla]]></content:encoded>
    </item>
  </channel>
</rss>
