Humans author specs; agents write everything that merges to main. A tour of the harness that makes that safe to ship — sandboxing, producer/verifier separation, bounded autonomy, and provenance by construction.
Programmable · 19 March 2026 · earlier at SecTalks Gold Coast & HCKSYD, 2025
Security loses to shipping because breaches are invisible work and features get the applause. A working engineer’s tour of where security actually breaks in everyday code — threat modelling, input and response validation, authorisation (IDOR), secret management, the software supply chain, and PII — with concrete failure modes (SQLi, path traversal, ReDoS, algorithmic-complexity DoS) and the pragmatic defences that stop them.