Code security for new coders

What it claims

Datadog Security Labs argues that people building apps with coding agents can cover the basics without becoming security experts. The basics are: keep secrets out of code, scan first-party and third-party code, update dependencies, and ask the agent to check for common vulnerabilities. It cites the PHP2Shell vulnerabilities, disclosed in October 2026, as the motivating case. These are two PHP flaws that could let an attacker take control of a website's server. The post says PHP runs on more than 70% of websites and that some organizations took services offline while patching. The post gives no CVE identifiers or affected versions.

A specific claim about agents: coding agents pull in dependencies by default and often rely heavily on outdated versions. The post separates two dependency risks. Vulnerabilities are accidental and usually fixed by upgrading. Malicious packages are deliberate and, per the post, becoming more common.

How to use it

The post splits agent prompts into two phases. Before any code is written, ask what sensitive data the app handles and how each type should be protected, and which authentication and authorization approach fits. After the code exists, ask the agent to justify its decisions. Doing so makes it re-read the code and may surface fixes. The follow-up prompts beyond the summary's examples are:

• What security tradeoffs did you make to keep this simple, and what would you fix before real users touch this?
• If you were a penetration tester, what's the first thing you'd try to break in this app?
• Are default credentials or debug modes left enabled anywhere?
• Is there a .env or config file here, and is it excluded from version control (.gitignore)?
• Are cloud storage buckets, databases, or admin panels publicly accessible when they shouldn't be?
• If this is deployed, what's exposed to the internet that doesn't need to be?

On tool choice, the post gives tradeoffs the summary omits. SAST scans code without running it and catches issues early, but produces more false positives. IAST watches data flow in a running app, so it runs later in delivery and tends to be more accurate. DAST runs preconfigured tests against a running app and is not a substitute for SAST or IAST. Most SCA tools also report the version to upgrade to.

For supply chain risk, Datadog names two open source tools of its own. GuardDog flags malicious packages. Supply Chain Firewall blocks malicious packages from being installed. Datadog Code Security, the commercial product, covers SCA, SAST, IAST, IaC and secret scanning but not DAST.

Limits

The post is an introductory primer and says its question list is not exhaustive. It names no open source scanners other than Datadog's two tools, and it gives no install commands or links in the text. Its claim about agents favoring outdated dependency versions comes with no data. Asking the agent to review its own code is the main check it recommends, and the post does not discuss how reliable that self-review is.