Securing Claude Code: Guardrails for AI-Assisted Development - Jim Manico
Securing Claude Code: Guardrails for AI-Assisted Development - Jim Manico
AI coding assistants are now part of software development, but most teams still deploy them without meaningful security controls. This talk shows how to use Claude Code safely in real engineering environments through proper repository setup, machine-readable requirements, structured prompts, reusable skills, and workflow discipline based on Issue - Plan - Code. It also covers practical guardrails such as hooks, managed settings, sandboxing, and review controls, along with the current attack surface around AI-assisted development, including prompt injection, plugin and MCP abuse, insecure generated code, and permission bypasses. The goal is to show how coding agents can be guided toward secure code up front and then constrained, monitored, and verified before they become another unmanaged attack surface.
SPEAKER BIO:
Jim Manico is the founder of Manicode Security, a secure coding educator, and a renowned leader in the OWASP and application security community. After recognizing in the late 1990s that security was too often treated as an afterthought in web development, he dedicated his career to teaching and advancing secure coding practices. Today, Jim provides expert training in secure coding, security engineering, and AI security. He is a Java Champion and the author of Iron-Clad Java: Building Secure Web Applications. As a professional educator, he helps global organizations strengthen their software development lifecycles while actively exploring the leading edge of AI automation. Within OWASP, Jim is widely known as a Global Board member in 2013-2016 and for his leadership across multiple major projects, including the OWASP Cheat Sheet Series, OWASP ASVS, OWASP Java Encoder, and, most recently, the OWASP AI Security Verification Standard (AISVS).
This talk was presented at the OWASP London Chapter Meetup on April 14th 2026, kindly hosted by @thoughtmachine903 and kindly sponsored by @semgrep and @escapetechhq
#owasplondon #aisecurity #claudecode #owasp