Goatfied blog
Developer-to-developer writing. No fluff. Just what worked, what failed, and what shipped.
security
Prompt injection in code repositories allows malicious instructions in README or config files to manipulate LLM agents that read, commit, or execute code autonomously.
security
Sandboxing untrusted tool calls isolates AI agent actions from production systems, preventing destructive commands through containerization and permission boundaries.
security
AI agents generate and commit code faster than post-commit scanning can catch secrets, requiring detection before file creation rather than after.
security
PR triage automation uses risk scoring to prioritize code reviews based on change impact, contributor history, and affected systems rather than simple rule-based labels.
security
Pull request summaries improve code review quality by stating what changed, why it changed, and what risks need scrutiny without assuming shared context.
