Skip to main content
CodeStax

CodeStax blog

Guides for securing the code AI writes.

Practical, evidence-first writing on AI application security, MCP servers, dependencies and the code review habits that keep them safe.

  1. SAST vs SCA: what each one finds, and why you need both

    SAST and SCA are the two scans almost every security programme starts with, and they are easy to confuse. One reads your code, the other reads your dependencies. Here is what each finds, with examples, and how to run them together without drowning in findings.

    AppSec basics7 min read

  2. Vibe coding security: a checklist for shipping AI-written code safely

    AI assistants write working code fast, and they repeat the same security mistakes: exposed keys, missing authorisation checks, insecure defaults and made-up packages. Here are the patterns to look for and a checklist for every stage from prompt to production.

    AI security7 min read

  3. The OWASP Top 10 for LLM applications, mapped to code

    The OWASP Top 10 for LLM Applications names the risks. This guide shows what each one looks like in a pull request: the vulnerable pattern, the fix, and how to catch it before it merges.

    AI security10 min read

  4. What is an AI-BOM? A practical guide to AI bills of materials

    An SBOM tells you which libraries you ship. An AI-BOM tells you which models, providers, agents and MCP servers your code depends on, and how they connect. Here is what goes in one, which formats to use, and how to keep it current.

    AI security9 min read

  5. MCP server security: a practical guide for teams shipping AI agents

    Every MCP server you connect is code your model can call with your privileges. This guide covers the six ways that trust goes wrong, with code, configuration and a checklist.

    AI security12 min read