For a repository where AI assistants write much of the code, run five automated checks on every pull request: secret scanning, dependency review, vulnerability matching on the lockfile, static analysis, and a frozen install with tests. Together they catch the common failures at low cost.
Why automation, not only review
Reviewers tire, and AI-written code tends to look polished. A Stanford user study found assistant users wrote less secure code while feeling more confident about it. Confidence is not a control. Automated checks do not share it.
The five checks
1. Secret scanning. Runs on the diff, ideally before commit and again in CI. Catches pasted keys and default passwords. MITRE's CWE-798 explains why one leaked credential can be so damaging.
2. Dependency review. Shows added and updated packages, including indirect ones, with release dates and known vulnerabilities. Make it a required check.
3. Vulnerability matching on the lockfile. Run on a schedule as well as on pull requests, because advisories appear after code is merged.
4. Static analysis. Looks for injection, unsafe deserialization and similar patterns. It will not find missing authorization reliably, but it catches a lot of the rest.
5. Frozen install plus tests. npm ci or hash checked pip installs make the build match the lockfile. Tests, including abuse cases, run after.
Order and cost
Run the fast checks first. Secret scanning and dependency review take seconds. Static analysis and full test suites take longer and can run in parallel. Fail the pull request on high severity findings and let lower ones create tickets.
Tune the noise
A scanner that cries wolf gets bypassed. Start with a strict threshold on a small set of rules, then widen. Reachability information helps you rank which vulnerable dependency findings matter, since a vulnerable function your code never calls is lower priority.
What this stack does not cover
It will not judge design flaws, business logic errors or a subtle authorization gap. Keep human review for code that touches authentication, money or sensitive data. See the review checklist.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, and policies and gates that can block a pull request on these checks. A free scan at gold.safeguard.sh/scan shows a baseline.
Click through it at your own pace, or open it full screen.
Rollout order
Do not switch everything on in one day. Week one, secret scanning and required dependency review. Week two, lockfile vulnerability matching and the frozen install. Week three, static analysis in report only mode, then enforce on high severity once the noise is tuned. Each step is small enough that developers see the benefit before the friction.
Quick check
Which single check should a small team add first?
Secret scanning plus a required dependency review on pull requests. Both are quick to set up and block the most expensive mistakes.
Sources
- Do Users Write More Insecure Code with AI Assistants? (arXiv)
- CWE-798: Use of Hard-coded Credentials (MITRE)
- GitHub documentation: about dependency review
Last reviewed: 19 October 2026.
