Safe Builders 2026
These 21 people teach builders how to ship with AI tools without getting hurt. We picked each one for their work. Nobody paid to be here. A place on this list does not mean that a person uses or endorses Vigilance.
Teaches application security to developers through training, a blog, and the book Alice and Bob Learn Secure Coding.
One lessonApply the same security controls to your editor, build pipeline, code repository, and package registry, not only to your dependencies.
Start hereSoftware Supply Chain: Bigger (and Scarier) Than We Realize
Researches npm and AI agent security and publishes a practical checklist for safer package installs.
One lessonTurn off install scripts with ignore-scripts, and use npm ci with a committed lockfile so installs stay predictable.
Start hereAwesome npm Security Best Practices
Writes about Python and open source supply chain security, including dependency cooldowns, Sigstore, and SBOMs.
One lessonSet pip's uploaded-prior-to option to P7D so installs skip package versions published in the last seven days.
Start herepip v26.1 adds support for relative dependency cooldowns
Teaches developers how to direct and review AI coding agents, and wrote the book Beyond Vibe Coding.
One lessonRead the test changes before the code, because agents can rewrite assertions to match broken behavior and turn checks green.
Start hereAgentic Code Review
Documents hands-on AI tool use and named the lethal trifecta of private data, untrusted content, and outside communication.
One lessonNever give one agent all three: private data, untrusted content, and a way to send data out. Remove at least one.
Start hereThe lethal trifecta for AI agents: private data, untrusted content, and external communication
Finds and publishes real vulnerabilities in coding agents such as Copilot, Claude Code, Cursor, and Windsurf.
One lessonRequire human approval before an agent edits files, and treat agent settings files as security-sensitive when you threat model.
Start hereGitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)
Writes a weekly newsletter on AI and security news, including attacks on AI tools and agent safety.
One lessonCheck the publisher and code of any package an AI assistant recommends, because attackers can fake GitHub stars, forks, and commit history.
Start hereUnsupervised Learning NO. 547
Teaches prompt hacking and AI red-teaming, and argues builders must limit agent permissions because guardrails cannot stop every attack.
One lessonLimit what an agent can read and send, sandbox untrusted code, and trim permissions, since no guardrail stops every prompt injection.
Start hereThe AI Security Industry is Bullshit
Curates a weekly roundup of vibe coding news, including security issues with AI tools and packages.
One lessonCheck every package your AI assistant suggests against an allowlist or checksums before installing, as you would a teammate's pull request.
Start hereVibe Coding Weekly #49
Teaches product builders how to vibe code with context, specs, and review before shipping.
One lessonRun a security check on generated code before shipping, since code that passes syntax checks can still fail on authentication and data rules.
Start hereVibe Coding Hub 2026: Guides, Prompts & Builds for Product Builders
Explains habits for building with AI in small reviewed steps with security rules in every prompt.
One lessonConfirm that every package the AI suggests exists before you install it, because attackers can register hallucinated package names.
Start hereVibe Coding Best Practices: 7 That Work, 3 Traps to Avoid
Shows builders how to audit the editor extensions and AI tools that sit on their machines.
One lessonList every extension in your editors, remove the ones you do not need, and pin versions of high-privilege AI extensions.
Start here3,800 GitHub Repos Stolen by One VS Code Extension. Your Cursor Setup Is the Next Attack Surface.
Shares how he builds a real SaaS product with Claude Code, including tests and command guardrails.
One lessonPut destructive database commands in Claude Code's deny list and routine safe commands in the allow list. Expect the agent to try workarounds.
Start hereHow to Actually Use Claude Code to Build Serious Software
Teaches beginners to use Claude Code step by step, including permissions, plan mode, and where to keep API keys.
One lessonStay in Plan Mode or Ask Before Edits while Claude proposes work, and pre-approve only low-risk read-only commands.
Start hereThe ULTIMATE Claude Code Tutorial (Claude Code Full Course)
Teaches how to move AI-built apps toward production with security basics and guardrail files.
One lessonKeep API keys and database credentials in environment variables and server-side code, never in client-side scripts.
Start hereHow to Make Vibe Coding Production-Ready (Without Losing Your Mind)
Teaches non-programmers to use Claude Code, starting with a folder they understand and approving each change.
One lessonPoint Claude Code at one folder you understand and read each proposed change before you approve it.
Start hereWeek 1: Claude Code for Non-Coders
Explains vibe coding for beginners and treats security as a manual review step.
One lessonRun a scanner such as Snyk or Semgrep on every AI-generated change, and review login, permission, and payment code by hand.
Teaches non-coders to build with Claude Code and when to hand work to a human developer.
One lessonGive Claude one empty project folder with no passwords or private files, and keep nothing in it that you would hate to lose.
Start hereVibecoding, on How to AI
Teaches practical security habits for AI-assisted developers, such as secret scanning and vetting suggested packages.
One lessonAdd a pre-commit secret scanner such as Gitleaks so a commit containing an API key is blocked before it leaves your machine.
Start hereSecuring the Vibe Coding Workflow: Practical Security Habits for AI-Assisted Developers
Teaches non-coders to use Claude Code safely with project folders, copies, and plan-first work.
One lessonNever point Claude Code at your home directory. Give it one project folder and keep originals where it cannot reach them.
Start hereClaude Code for non-coders
Maven (Claude for Non-Technical Operators)
Teaches non-developers to use Claude with skills, connectors, and automations in a live cohort course.
One lessonSet up your workspace folders and permissions before you let Claude work with your files and connected tools.
Start hereClaude for Non-Technical Operators: Advanced Certification
Who taught you to build more safely with AI? Send us their name and one piece of their work. We read every nomination and add new names to the list.