CD-SEC-01 - Blind Trust
Developers accept AI-generated code, marketplace templates, and platform defaults as correct and safe without verification.
Intent & Description
'
🎯 Intent
Prevent blind trust in AI-generated code, templates, and defaults that can introduce security vulnerabilities.
📋 Context
Citizen developers accept AI-generated code, marketplace templates, and platform defaults as correct and safe without verification, driven by automation bias, availability heuristics, and anchoring on the first template they see. This is treated as the foundational risk that amplifies the other nine.
💡 Solution
Implement secure-by-default platform configuration. Create a vetted, standardized component library. Use pre-deployment automated security review of generated/imported code. Implement just-in-time security nudges inside the builder itself. Apply the Blind Trust Secure Framework pillars.'
Real-world Use Case
Source
📌 TL;DR
Prevent blind trust in AI-generated code. Use secure defaults, vetted components, automated security review, and in-builder security guidance.
Advantages
- Reduces automation bias
- Establishes security standards
- Enables automated security checks
- Embeds security in development workflow
Disadvantages
- May slow development velocity
- Requires ongoing library maintenance
- Security nudges may be ignored