Notes from the factory
Shipping production AI apps, agent-assisted engineering, and fixed-price delivery for the German mid-market.
- ai-governance6 min
GitHub Copilot Enterprise Audit Logs: What They Capture and What They Miss for AI Code Governance
GitHub Copilot Enterprise ships audit logs for admin actions and policy changes, but engineering leaders evaluating it for AI code governance often assume those logs also cover what Copilot suggested and what got merged. They don't — and that gap is where governance programs quietly fail their next audit.
- AI security5 min
The MCP Server CVE Tracking Gap in AI Coding Agents
More than 40 CVEs hit Model Context Protocol implementations in early 2026, including a 9.6-severity flaw in a package with 437,000+ downloads — and most engineering teams have no process for knowing which of their AI coding agents were exposed.
- ai-governance4 min
EU AI Act August 2026 Deadline: What Applies to AI Coding Agents
The EU AI Act's high-risk deadline moved to December 2027, but Article 50 transparency, GPAI penalty enforcement, and market surveillance authority still activate August 2, 2026 — and all three can reach a pull request.
- ai-governance4 min
AI Coding Agent Runaway Detection: Five Signals That a Model Is Producing Off-Pattern Code
AI coding agents go off-pattern before anyone notices — and 42% of committed code is now AI-generated. Here are five behavioral signals that flag a model producing anomalous output before it reaches production.
- devsecops4 min
How to Configure Required Status Checks for AI-Assisted Pull Requests
Required status checks are the last deterministic enforcement layer between AI-generated code and your main branch. Here is how to configure all five for AI-assisted pull requests.
- ai-governance5 min
ISO 27001 and AI Coding Agents: Which Controls Need Updating Before Your Next Audit
AI coding agents create evidence gaps in ISO 27001:2022 controls for supplier relationships, secure development, and cloud services. Here is which Annex A controls need AI-specific scope updates before your auditor asks.
- ai-governance4 min
AI Coding Agent Procurement: A Security Due Diligence Checklist for Engineering Leaders
Seven security due diligence questions every engineering leader must ask before authorizing an AI coding agent for enterprise use — covering data handling, audit logs, supply chain risk, and access control.
- ai-governance4 min
GDPR and AI-Generated Code: Three Data Privacy Risks in Every Pull Request
AI coding agents create GDPR exposure points most teams have not mapped — purpose expansion, personal data in context windows, and undocumented third-party data transfers. Here is what engineering teams need to govern before the next pull request merges.
- AI security4 min
AI Coding Agent Sandboxing: How to Contain Tool Access in CI/CD Pipelines
Docker containers offer a false sense of security for AI coding agents in CI/CD — learn four containment controls that actually restrict tool access and limit blast radius.
- devsecops4 min
AI Coding Agent Data Exfiltration: How the Context Window Became an Attack Vector
Over 30 CVE-assigned vulnerabilities in production AI coding tools reveal how attackers exploit the agent context window to steal credentials and source code without triggering conventional security alerts.
- ai-governance4 min
AI-Generated Code Attribution: How to Track What Your Agents Wrote in Pull Requests
Most engineering teams cannot answer which pull requests were written by an AI coding agent. This guide shows how to build attribution tracking into your PR workflow before compliance deadlines force the issue.
- ai-governance4 min
How to Measure AI Code Governance Maturity in Your Engineering Org
Only 13% of engineering organizations have governance structures for AI coding agents. This four-level maturity model gives you a scored baseline and a concrete path to enforcement and optimization.
- devsecops4 min
AI-Generated Pull Request Monitoring: Five High-Risk Signals to Catch Before Merge
AI-generated code has a 45% security flaw rate at submission yet passes syntax checks nearly every time. Here are the five pull request signals engineering teams need automated detection for — before merge, not after.
- AI security4 min
How to Build an MCP Server Allowlist Policy for Enterprise AI Coding Agents
A study of 1,899 open-source MCP servers found 5.5% carried tool-poisoning vulnerabilities — here is how to build a four-component MCP server allowlist policy that prevents unauthorized access and runtime compromise for enterprise AI coding agent deployments.
- ai-governance4 min
How to Build a Business Case for AI Code Governance: Numbers That Land With Leadership
Engineering leaders have the risk data — 45% AI code failure rates, a $670K shadow AI breach premium. Here is how to structure the business case so finance and security leadership act on it.
- ai-governance4 min
NIST AI RMF for AI Coding Agents: A Practical Mapping for Engineering Teams
The NIST AI Risk Management Framework's four functions map directly onto AI coding agent governance gaps — here is how engineering teams can apply GOVERN, MAP, MEASURE, and MANAGE at the pull request level.
- AI security7 min
AI Coding Agents and Secret Sprawl: What 28 Million Leaked Credentials Show in 2026
AI coding agents commit hardcoded secrets at more than double the human baseline rate — 3.2% versus 1.5%. Here is what the 2025–2026 data shows about AI-driven secret sprawl and how engineering teams can close the governance gap at the pull request boundary.
- devsecops4 min
How to Configure Mandatory Code Review Gates for AI-Generated Pull Requests
Mandatory code review gates for AI-generated pull requests need more than one required approver. Here is a three-tier configuration model that matches enforcement to actual risk level.
- devsecops4 min
How to Scope AI Coding Agent Permissions: A Least-Privilege Guide for Engineering Teams
AI coding agents with excessive permissions face 4.5x more security incidents than least-privilege deployments. Learn why AI coding agent permissions accumulate unchecked and the four scope controls engineering teams must implement.
- devsecops4 min
Why Your SCA Tool Won't Catch What AI Coding Agents Pull In
AI coding assistants recommend vulnerable or nonexistent dependencies in 80% of cases — here is what software composition analysis misses and how to close the gap at the pull request layer.
- ai-governance5 min
SOC 2 and AI-Generated Code: What Your Next Audit Will Ask About
SOC 2 auditors are mapping Trust Services Criteria to AI coding agent activity before formal AICPA guidance exists. Here is what engineering teams need to document now.
- AI security4 min
How to Vet Third-Party MCP Servers Before Your AI Coding Agents Use Them
One vulnerable package compromised 437,000 developer environments via CVE-2025-6514. Here is an eight-check pre-onboarding process for every third-party MCP server your AI coding agents connect to.
- devsecops4 min
How to Build an AI Coding Agent Incident Response Playbook
76% of businesses have experienced an AI-related security incident, yet most engineering teams have no playbook for AI coding agents. Here is the five-step response framework every DevSecOps team needs.
- ai-governance4 min
How to Write an Acceptable Use Policy for AI Coding Agents
Most enterprise AI policies were designed for chatbots, not coding agents that commit code, call APIs, and open pull requests autonomously. Here is what an acceptable use policy for AI coding agents must cover.
- ai-governance4 min
What to Look for in an AI Code Governance Platform: Five Capabilities That Actually Matter
45% of AI-generated code contains known security vulnerabilities. Engineering teams evaluating AI code governance platforms need to know the five capabilities that separate real enforcement from security theater.
- devsecops4 min
How to Run a Quarterly AI Coding Agent Security Audit
A step-by-step checklist for engineering teams to audit AI coding agent permissions, secrets exposure, CI/CD gates, and logging every quarter — before gaps become incidents.
- ai-governance4 min
How Automated PR Risk Scoring Keeps AI-Generated Code From Slipping Past Review
31% of AI-assisted pull requests now merge without any review. This guide explains how automated PR risk scoring works in CI pipelines to triage AI-generated code at scale.
- AI security8 min
45% of AI-Generated Code Fails Security Checks — What the 2025–2026 Data Says
Security pass rates for AI-generated code have remained flat at 55% across two years of model releases. Here is what the primary research shows and how engineering teams should respond.
- ai-governance8 min
Who Owns EU AI Act Compliance? Six Misconceptions Engineering Organizations Need to Correct
The EU AI Act creates overlapping obligations for providers and deployers — but accountability often falls through the cracks. Six misconceptions GRC leads and compliance engineers must correct.
- ai-governance4 min
How to Set a Pull Request Size Policy for AI-Generated Code
AI-generated pull requests contain up to 2.74x more security vulnerabilities than human-written ones and arrive far larger than standard review processes can absorb. Here is how to define and enforce a PR size policy built for the age of AI coding agents.
- devsecops4 min
How to Enforce Branch Protection Rules for AI-Generated Pull Requests
Standard branch protection rules leave critical gaps when AI coding agents enter your PR workflow. Here are the six settings to configure and three audit log signals to watch.
- devsecops4 min
How to Add CI/CD Security Gates for AI-Generated Code
Most CI/CD pipelines were built for human-paced code. Here is how to add the specific security gates that catch the failure modes AI coding agents introduce — and what to measure after you ship.
- ai-governance4 min
AI-Generated Code License Compliance: What Engineering Teams Must Check Before Merging
AI coding agents can silently introduce copyleft license obligations into your codebase. Here is how engineering teams can detect, track, and govern license risk in AI-generated pull requests.
- AI security5 min
Shadow AI Coding Agents: Detecting Unauthorized Tools Before They Become a Security Incident
Shadow AI coding agents bypass code review, audit trails, and data controls. Here is how engineering teams can detect unauthorized AI tool use and close the governance gap before it becomes a breach.
- AI security4 min
What Your SBOM Misses About AI Coding Agents (And How to Close the Gap)
Standard SBOM formats track packages and dependencies — not the AI coding agents, model versions, MCP server connections, or system prompts generating your code. Here's what the February 2026 CISA-G7 AI SBOM guidance covers, and what still falls through the gap at your PR gate.
- AI security4 min
Prompt Injection in Pull Requests: How AI Coding Agents Become an Attack Vector
When AI coding agents review pull requests, they cannot reliably distinguish code from embedded instructions. Security research shows 73% of tested platforms fail critical trust boundaries — and the PR is the most exploitable surface in most development workflows.
- devsecops5 min
How to Onboard AI Coding Agents Without Expanding Your Attack Surface
A practical five-step checklist for onboarding AI coding agents — covering credential access, merge gate conditions, dependency pinning, and the quarterly governance cadence that keeps your attack surface from growing after day one.
- ai-governance4 min
Five Metrics Every Engineering Team Should Track for AI-Generated Code Risk
AI-generated code introduces 1.7x more issues than human-written code. Here are the five metrics engineering teams should track to govern AI-assisted codebases before risk accumulates.
- ai-governance4 min
What Pull Request Risk Scoring Catches That Code Review Misses
Manual code review misses the systematic vulnerabilities AI coding agents introduce at scale. This is what pull request risk scoring catches instead.
- ai-governance8 min
EU AI Act Conformity Assessment: A Step-by-Step Approach for Engineering Teams
What the EU AI Act's conformity assessment process generally requires for high-risk AI systems, the five steps engineering teams should work through, and how to navigate the choice between internal control and third-party notified body review.
- ai-governance4 min
Your PR Review Process Was Designed for Human Code. AI Just Changed the Math.
AI-generated pull requests carry nearly twice the defect rate of human-authored ones—and standard review workflows weren't built for that. Here's what the data shows and what engineering teams need to change.
- devsecops4 min
How to Set Up Automated Secrets Detection in AI-Assisted Pull Requests
AI-assisted commits leak secrets at twice the baseline rate. Here is how to build three detection layers that catch credentials before they reach version history.
- devsecops9 min
MCP Gateway Security: The Threat Landscape and Defense Playbook for Engineering Teams
MCP gateway security is the enforcement gap most engineering teams have not yet closed. This guide covers the four primary attack vectors targeting MCP servers, what 2025-2026 vulnerability research reveals about the ecosystem, and eight controls that materially reduce your exposure.
- ai-governance9 min
Human Oversight of AI Coding Agents: Addressing EU AI Act Article 14
EU AI Act Article 14 requires specific human oversight capabilities for high-risk AI systems. Here is what the regulation generally requires and how development teams can begin building compliant oversight controls for AI coding agents before the August 2026 application date.
- ai-governance8 min
AI Code Review Policy: The Six Components Every Engineering Team Needs in 2026
Only 18% of enterprises have formal guidelines for AI-generated code, yet AI now accounts for 42% of all committed code. Here is what a working AI code review policy actually contains and how to enforce it at the pull request level.
- ai-governance8 min
How to Govern Autonomous Coding Agents: A Practical Framework for Engineering Teams
A four-layer governance framework for autonomous coding agents — covering pre-task policy, PR risk scoring, human escalation rules, and audit trail — with 2026 data on why ungoverned agents are a production risk.
- AI security8 min
Copilot Security Enforcement: Why Native Controls Aren't Enough for Enterprise Teams
AI-assisted commits expose secrets at more than double the human baseline rate. Here is why native security controls in AI coding assistants were not designed for policy enforcement — and what an effective enforcement stack looks like.
- ai-governance8 min
FMEA for AI Pull Requests: How to Score Risk Before It Ships
Learn how to apply Failure Mode and Effects Analysis (FMEA) methodology to AI-generated pull requests — scoring severity, occurrence, and detection to prioritize the risks that actually ship to production.
- devsecops4 min
Slopsquatting: How AI Coding Agents Turn Package Hallucinations Into Supply Chain Attacks
AI coding agents hallucinate package names at rates between 5% and 28% — and attackers are pre-registering those names. Here is how to add slopsquatting detection to your PR merge gate.
- ai-governance4 min
How to Set Up a GitHub Copilot Enterprise Governance Policy: A 5-Step Guide
A practical five-step guide to building a GitHub Copilot enterprise governance policy — covering usage audits, acceptable use rules, enterprise controls, PR-layer enforcement, and ongoing monitoring.