Methodologies

Techniques for building with LLMs and coding agents that are useful in any project, cite a primary source, and hold up to a senior security review. Entries go through a monthly inclusion review before publishing and a quarterly check for staleness — anything overcome by events is archived, not left to rot on this page.

• Validate everything crossing the LLM/tool boundary, not just user input

  Treat the arguments an LLM generates for a tool call as untrusted input — validate and sanitize them at the same boundary you'd validate a network request, before they reach SQL, a shell, or a file path.

  Source: OWASP Top 10 for LLM Applications — Prompt Injection (LLM01) & Insecure Output Handling · Last reviewed Mon Sep 07 2026 00:00:00 GMT+0000 (Coordinated Universal Time)

• Scope your coding agent to least privilege, not full trust

  Give an AI coding agent the narrowest file, network, and command access that lets it do the task — treat every broader grant as a decision, not a default.

  Source: OWASP Top 10 for LLM Applications — Excessive Agency (LLM08) · Last reviewed Mon Sep 07 2026 00:00:00 GMT+0000 (Coordinated Universal Time)