Home/
Part XIII — Expert Mode: Systems, Agents, and Automation/38. Building a Code-Change Agent Safely/38.5 Security gates and dependency scanning
38.5 Security gates and dependency scanning
Overview and links for this section of the guide.
On this page
Dependency Hallucination
Models love to import packages that don't exist ("package hallucination").
Gate: If the agent adds a new line to `package.json`, verify that the package exists on npm and has > 1000 downloads. Do not install obscure packages automatically.
Code Injection
Scan the generated code for dangerous patterns: - `eval()` - `exec()` - Hardcoded credentials (`password = "123"`)
Use tools like Semgrep or Bandit in your pipeline.