{"id":40765669,"url":"https://github.com/Arcanum-Sec/sec-context","last_synced_at":"2026-01-30T20:00:41.081Z","repository":{"id":333711512,"uuid":"1137682964","full_name":"Arcanum-Sec/sec-context","owner":"Arcanum-Sec","description":"AI Code Security Anti-Patterns distilled from 150+ sources to help LLMs generate safer code.","archived":false,"fork":false,"pushed_at":"2026-01-20T16:30:57.000Z","size":214,"stargazers_count":215,"open_issues_count":0,"forks_count":41,"subscribers_count":3,"default_branch":"main","last_synced_at":"2026-01-21T01:31:04.859Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://arcanum-sec.com","language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Arcanum-Sec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-01-19T17:34:36.000Z","updated_at":"2026-01-21T01:16:19.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/Arcanum-Sec/sec-context","commit_stats":null,"previous_names":["arcanum-sec/sec-context"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/Arcanum-Sec/sec-context","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arcanum-Sec%2Fsec-context","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arcanum-Sec%2Fsec-context/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arcanum-Sec%2Fsec-context/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arcanum-Sec%2Fsec-context/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Arcanum-Sec","download_url":"https://codeload.github.com/Arcanum-Sec/sec-context/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Arcanum-Sec%2Fsec-context/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28918235,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-30T19:10:10.838Z","status":"ssl_error","status_checked_at":"2026-01-30T19:06:40.573Z","response_time":66,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-21T18:00:26.186Z","updated_at":"2026-01-30T20:00:41.075Z","avatar_url":"https://github.com/Arcanum-Sec.png","language":"HTML","funding_links":[],"categories":["HTML"],"sub_categories":[],"readme":"# Sec-Context - AI Code Security Anti-Patterns for LLMs\n\n**A comprehensive security reference distilled from 150+ sources to help LLMs generate safer code**\n\n[Landing anmd github-pages website](https://arcanum-sec.github.io/sec-context/)\n\n## The Problem\n\nAI coding assistants are everywhere. **97% of developers** now use AI tools, and organizations report **40%+ of their codebase** is AI-generated. But there's a critical gap: AI models consistently reproduce the same dangerous security anti-patterns, with studies showing:\n\n- **86% XSS failure rate** in AI-generated code\n- **72% of Java AI code** contains vulnerabilities\n- AI code is **2.74x more likely** to have XSS vulnerabilities than human-written code\n- **81% of organizations** have shipped vulnerable AI-generated code to production\n\nWe built this guide to close that gap.\n\n---\n\n## What We Created\n\nTwo comprehensive security anti-pattern documents designed specifically for AI/LLM consumption:\n\n### ANTI_PATTERNS_BREADTH.md (~65K tokens)\nA complete reference covering **25+ security anti-patterns** with:\n- Pseudocode BAD/GOOD examples for each pattern\n- CWE references and severity ratings\n- Quick-reference lookup table\n- Concise mitigation strategies\n\n### ANTI_PATTERNS_DEPTH.md (~100K tokens)\nDeep-dive coverage of the **7 highest-priority vulnerabilities** with:\n- Multiple code examples per pattern\n- Detailed attack scenarios\n- Edge cases frequently overlooked\n- Complete mitigation strategies with trade-offs\n- Why AI models generate these specific vulnerabilities\n\n---\n\n## The Top 10 AI Code Anti-Patterns\n\nBased on our ranking matrix (Frequency × 2 + Severity × 2 + Detectability), these are the most critical patterns to watch for:\n\n| Rank | Anti-Pattern | Priority Score | Key Statistic |\n|------|--------------|----------------|---------------|\n| 1 | **Dependency Risks (Slopsquatting)** | 24 | 5-21% of AI-suggested packages don't exist |\n| 2 | **XSS Vulnerabilities** | 23 | 86% failure rate in AI code |\n| 3 | **Hardcoded Secrets** | 23 | Scraped within minutes of exposure |\n| 4 | **SQL Injection** | 22 | \"Thousands of instances\" in AI training data |\n| 5 | **Authentication Failures** | 22 | 75.8% of devs wrongly trust AI auth code |\n| 6 | **Missing Input Validation** | 21 | Root cause enabling all injection attacks |\n| 7 | **Command Injection** | 21 | CVE-2025-53773 demonstrated real-world RCE |\n| 8 | **Missing Rate Limiting** | 20 | Very high frequency, easy to detect |\n| 9 | **Excessive Data Exposure** | 20 | APIs return full objects instead of DTOs |\n| 10 | **Unrestricted File Upload** | 20 | Critical severity, enables RCE |\n\n---\n\n## How to Use These Files\n\n### Important: These Are Large Files\n\n- **Breadth version:** ~65,000 tokens\n- **Depth version:** ~100,000 tokens\n\nThis is intentional. They're designed to be comprehensive references.\n\n### Option 1: Large Context Window Models\nIf you're using a model with 128K+ context (Claude, GPT-4 Turbo, Gemini 1.5), you can include the entire breadth document in your system prompt or as a reference file.\n\n### Option 2: Pieces for Smaller Contexts\nExtract specific sections relevant to your task:\n- Working on authentication? Pull the Authentication Failures section\n- Building an API? Use the API Security and Input Validation sections\n- Handling file uploads? Reference the File Handling section\n\n### Option 3: Standalone Security Review Agent (Recommended)\nThe ideal use case: deploy a dedicated agent that reviews AI-generated code against these patterns. This agent:\n- Takes code as input\n- Checks against all 25+ anti-patterns\n- Returns specific vulnerabilities found with remediation steps\n- Works as a guardrail between AI code generation and production\n\n### Option 4: Standalone Security Review Skill - Claude Code (Recommended)\nAnother ideal use case: deploy a dedicated skill in claude code that reviews AI-generated code against these patterns. This agent:\n- Takes code as input\n- Checks against all 25+ anti-patterns\n- Returns specific vulnerabilities found with remediation steps\n- Works as a guardrail between AI code generation and production\n\n```\n┌─────────────────┐     ┌──────────────────────┐     ┌─────────────┐\n│ AI Code Gen     │────\u003e│ Security Review Agent │────\u003e│ Reviewed    │\n│ (Copilot, etc.) │     │ + Anti-Patterns Guide │     │ Code Output │\n└─────────────────┘     └──────────────────────┘     └─────────────┘\n```\n\n---\n\n## Research Sources\n\nThis guide synthesizes findings from **150+ individual sources** across 6 primary research categories:\n\n### Primary Source Categories\n\n| Source Type | Examples | Key Contributions |\n|-------------|----------|-------------------|\n| **CVE Databases** | NVD, MITRE CWE, Wiz | 40+ CVEs documented including IDEsaster collection |\n| **Academic Research** | Stanford, ACM, arXiv, IEEE, USENIX | Empirical vulnerability rate studies |\n| **Security Blogs** | Dark Reading, Veracode, Snyk, Checkmarx, OWASP | Industry reports and analysis |\n| **Developer Forums** | HackerNews (17+ threads), Reddit (6 subreddits) | Real-world developer experiences |\n| **Social Media** | Twitter/X security researchers | Real-time incident documentation |\n| **GitHub** | Security advisories, academic studies | Large-scale code analysis |\n\n\n---\n\n## File Locations\n\n```\n├── ANTI_PATTERNS_BREADTH.md   # Full coverage, 25+ patterns\n├── ANTI_PATTERNS_DEPTH.md     # Deep dive, 7 critical patterns for now\n```\n\n---\n\n## Get Started\n\n1. **Grab the files**\n2. **Choose your approach** based on your context window and use case\n3. **Integrate** into your AI coding workflow as system prompt, RAG reference, or review agent\n4. **Generate safer code**\n\nThe goal isn't to replace human security review—it's to catch the obvious, well-documented anti-patterns that AI consistently reproduces, freeing up human reviewers for the subtle, context-dependent security decisions.\n\n---\n\n## Contributing\n\nFound a pattern we missed? Have a better example? PRs are welcome =)\n\n---\n\n*Built by synthesizing 150+ sources across academic papers, CVE databases, security blogs, and developer communities. Because AI shouldn't keep making the same security mistakes.*\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FArcanum-Sec%2Fsec-context","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FArcanum-Sec%2Fsec-context","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FArcanum-Sec%2Fsec-context/lists"}