Code security for new coders

What it is

A Datadog Security Labs primer (published around October 2026) for people building with coding agents who lack a security background. It separates first-party code, which the builder must fix, from third-party code, where the builder cannot fix the flaw but must use a version without it. It cites the PHP2Shell vulnerabilities, disclosed in October 2026, as motivation: they could let an attacker take over a server running PHP, and some organizations took services offline to patch. The page gives no CVE ids or affected versions for them.

What to do

The page's most reusable content is a set of prompts for the agent. Before any code is written, ask:

• What sensitive data will this app handle (passwords, payment info, personal data, API keys), and how should each type be protected?
• What authentication and authorization approach fits this app, and what are the tradeoffs?

After the code is written, the page suggests asking the agent to:

• Run a security review and check for OWASP top 10 vulnerabilities.
• Name the security tradeoffs it made and what to fix before real users arrive.
• Say what a penetration tester would try first.
• List third-party packages, and say which are outdated or have known vulnerabilities.
• Find hardcoded keys, passwords or tokens, and move them to environment variables or a secrets manager.
• Check for default credentials or debug modes left on.
• Confirm that any .env or config file is excluded through .gitignore.
• Check for public cloud buckets, databases or admin panels, and for anything exposed to the internet that does not need to be.

The page says these questions make the agent re-read its own code, which may lead it to suggest changes. The list is not exhaustive.

Choosing a tool

• SCA scans open-source dependencies for vulnerabilities and usually names the version to upgrade to.
• SAST scans first-party code without running it. It suits early detection but gives more false positives than the other types.
• IAST watches data flow in a running application. It is used later in delivery and tends to be more accurate.
• DAST runs pre-configured automated tests against a running application. It is not interchangeable with SAST or IAST.
• IaC scanning checks infrastructure files for risky settings.
• Secret scanning finds hardcoded credentials in the codebase.

Datadog also publishes two open source supply chain tools: GuardDog, which flags malicious packages, and Supply Chain Firewall, which blocks their installation.

Caveats

• The page says coding agents use dependencies by default and often rely heavily on outdated versions. It gives no data for this.
• It distinguishes accidental dependency vulnerabilities, fixed by upgrading, from deliberately malicious packages, which it says are becoming more common.
• It gives no commands, configuration or tool setup steps, and the Datadog products are described only by name.