Insecure Vibes: The Risks of AI-Assisted Coding

Foredragsholder

Tanya Janca

Secure Coding Trainer at She Hacks Purple

Tanya Janca, known online as SheHacksPurple, is the best-selling author of Alice and Bob Learn Secure Coding and Alice and Bob Learn Application Security. She is the CEO of She Hacks Purple Consulting, where she delivers high-impact, live, secure-coding training for engineering teams. She is also the host of DevSec Station Podcast.

Over 29 years in the industry Tanya has received numerous awards, spoken at events worldwide, and built a reputation as one of the most approachable and influential voices in application security. She has trained thousands of developers and security practitioners through her academies and live programs. Her experience includes counter-terrorism work, leading security for the 42nd Canadian federal election, as well as building and securing a vast range of applications. Today, she is recognized internationally as a leading authority on the security of software.

Om sesjonen

AI coding assistants like GitHub Copilot and ChatGPT are changing how developers write and ship

software, faster than security teams can keep up. But speed comes at a cost: "vibe coding"

encourages developers to trust confident-looking code that may be dangerously insecure.

In this talk, we'll look at real-world examples and research showing how AI tools replicate and amplify

insecure patterns, why traditional AppSec controls often fail to catch these issues in time, and how

teams can adapt. We'll explore modern strategies to make AI-assisted coding safer without making it

slow (secure RAG references, MCP enforcement layers in the IDE, guardrails, policy integration, and

developer education).

Whether you're on the AppSec side or writing code, this session will equip you with a clearer threat

model and practical tools to secure your AI-augmented SDLC.

Samtidig i programmet

1. 10:00 When defenders go low, we go high(level) - bypassing application control using stage 1 beacons 1 · Frimurerlosjen, rom 2
2. 10:00 PQC-migrasjon for store virksomheter 10 · HeartBox ,Teatersalen
3. 10:00 Hawaii Pizza – How dare you? (or do I really care?) 10 · HeartBox, Byscenen
4. 10:00 Sikkerhetskrav i randsonen: Slik treffer sikkerhetskravene underleverandørene 11- Breiseth, Storlon
5. 10:00 A Recipe for Resilience: Using Purdue and IEC 62443 to Secure Europe's Food Supply 2 · Home hotel Hammer, moen nede
6. 10:00 The Endpoint that walks: Mobile Devices as Physical Security Risks 2 · Home hotel Hammer, moen oppe
7. 10:00 Innsiderisiko: forskningsperspektiver og foreløpige funn 3 · Hvelvet, Gullsalen
8. 10:00 Sykt mange sikkerhetskrav i offentlig anskaffelse: Må det være sånn? 4 · Kommunestyresalen, Lillehammer rådhus
9. 10:00 En felles IAM-virkelighet for offentlig sektor, er det mulig? 5 · Kulturhuset Banken, Expedisjon
10. 10:00 Maritime næring i skuddlinjen - erfaringer fra dagene da USA og Israel angrep Iran 5 · Kulturhuset Banken, Festsalen
11. 10:00 Når tiden forsvinner. Strategier for fremtidens digitale beredskapsarbeid 5 · Kulturhuset Banken, Holbøsalen
12. 10:00 AI i digital etterforskning 5 · Kulturhuset Banken, Kafeen
13. 10:00 Maverick RiskJockey: en AI-drevet CISO-funksjon 6 · Lillehammer kino, sal 2
14. 10:00 10 «dumme» spørsmål - og hva de avslører om sikkerhetskulturen 6 · Lillehammer kino, sal 4
15. 10:00 Podcast O3C 7 · Microbryggeriet
16. 10:00 Et tu, vendor? A story of vendor ransomware leaks and heartaches 9 · Victoria Scandic, sal 1+2
17. 10:00 Multi-Agent Orchestration to Catch Bad Guys 9 · Victoria Scandic, sal 3