How to Harden AI Agents and Pave the Path for Vibe Coders

When traditionally non-technical employees ( "vibe coders") use LLMs to write and deploy code, the potential blast radius for misconfigurations, Internet exposed apps and incidents exponentially increases. Vibe coder direct agents operating probabilistically. Agents are overzealous and want to be helpful and will break security rules to get it done. Security teams cannot rely solely on paper policies and must start enforcing hardened, paved paths. In this episode of the AI Security Podcast, Ashish sits down with Nick Reva (linkedin.com/in/nickreva), Global Director, Engineering Security at DoorDash (doordash.com), to discuss how his team proactively secures AI agents and developer workflows. Nick breaks down the three primary AI archetypes within an organization- the AI champions, the professional software engineers, and vibe coders and outlines the specific guardrails needed for each. From pushing secure configuration files to local IDEs, hardening Claude.MD (claude.md) files to building safety belts that prevent agents from pushing code to non-enterprise remotes, Nick provides actionable strategies for securing the software development lifecycle at scale.

Questions asked:
(00:00) Introduction to Securing Vibe Coders and AI Agents(02:30) Nick Reva’s Background (SpaceX, Snapchat, DoorDash)(04:00) The Shift from Deterministic to Probabilistic Security Controls(05:30) The Dangers of Non-Technical Employees "Vibe Coding"(08:30) Paving the Path for Professional Software Engineers Using AI(11:30) Using Decorator Functions for Agent Authorization(15:30) Shifting Left: AI-Assisted Threat Modeling on Design Documents(18:30) Trusting AI: Using Ground Truth Data to Train PR Review Agents(21:30) Hardening Deployment Platforms (Vercel, Lovable) for Vibe Coders(25:00) The Importance of Claiming Enterprise Domains and Enforcing SSO(27:30) Developing "Safety Belts" to Prevent Code Pushes to Public Repos(31:30) AI for Security: Automating Incident Response Workflows(33:30) The Critical Role of Network Egress Containment in AI Incidents(39:30) Three Quick Wins for Implementing Security for AI(43:30) The "You Laugh, You Lose" Cybersecurity Joke Challenge

Resources spoken about during the episode:
DoorDash Engineering Blog (careersatdoordash.com/engineering-blog/?catego…)