Secure Agentic Software Development Beyond Vibe Coding

What you'll learn

⚡ Write agent-executable specs with acceptance criteria a machine can verify
⚡ Design least-agency permission tiers, sandboxes and default-deny network egress
⚡ Review agent diffs in ten minutes using a checklist tuned to real failure classes
⚡ Detect reward hacking — special-casing, fixture reads, weakened assertions, mocked-away logic
⚡ Build a seven-check CI gate: secrets, SAST, dependencies, tests, test integrity, SBOM, workflow audit
⚡ Generate SLSA build provenance and commit-level attribution auditors accept
⚡ Run containment and recovery when an agent damages a repository
⚡ Map your controls to NIST SSDF, ISO/IEC 42001, SOC 2 CC8.1 and PCI DSS Requirement 6

Requirements

❗ Comfortable with Git — branches, diffs, reverts, and reading a pull request
❗ Some prior use of a coding agent (Claude Code, Copilot, Cursor, Codex CLI or similar)
❗ Able to run a CLI and a container; you can read code in at least one language
❗ No prior security, static-analysis or compliance experience needed — all taught from scratch

Description

This course contains the use of artificial intelligence.
You already know how to get a coding agent to write code. That part is solved. What is not solved is everything that happens after it hits enter — who checks it, what it was allowed to touch, whether the tests it wrote mean anything, and whether anyone can tell six months later which commits an agent authored.
This is not another course about driving Claude Code or Copilot. It is a course about theengineering control system around coding agents — the part almost nobody teaches, and the part that decides whether agent velocity becomes throughput or becomes incidents.
What the evidence actually says
✨ DORA 2025: AI is an amplifier — it raises throughputand instability together.
✨ Veracode: across 80 tasks, models chose the insecure implementation about 45% of the time.
✨ METR: experienced developers measured 19% slower with AI while estimating they were 20% faster.
✨ GitGuardian: AI-assisted commits leak secrets at roughly twice the human rate.
The six controls you will build
✨Specify — agent-executable specs with machine-checkable acceptance criteria, non-goals and stop conditions.
✨Constrain — least-agency permission tiers, sandboxing, worktrees and default-deny egress.
✨Review — a checklist tuned to what agents actually get wrong, a ten-minute triage, and adversarial agent-vs-agent review.
✨Test — tests as a contract the agent cannot game, plus mutation testing to prove the suite has teeth.
✨Gate — seven blocking CI checks: secrets, static analysis, dependencies, tests, test integrity, SBOM and a workflow audit.
✨Prove — commit provenance, SBOM and signed attestations that answer an auditor without a human explaining.
Built around one company, one incident
Everything is taught through Meridian Ledger, a Series-B fintech that went agent-first and lost six hours of reconciliation when an agent deleted a runtime-injected credential during a release freeze. Every control in the course answers a specific thing that went wrong that Thursday.
Hands-on and tool-agnostic
Eight labs, six assignments and three role plays, all built on open-source tooling — Semgrep, gitleaks, OSV-Scanner, Syft, Grype, promptfoo, mutmut and zizmor. No lab requires a specific vendor's coding agent, because your control plane has to outlive your tool choices. You will break a repo on purpose, review a pull request with seven planted defects, catch a reward-hacked test suite, and wire a CI gate that blocks all of it.
Who this is for
Senior and staff engineers whose teams already merge agent-authored pull requests; application-security and platform engineers asked to make the AI rollout safe; and engineering leaders accountable for both the velocity number and the incident.

Who this course is for

⭐ Senior and staff engineers whose review load has become the bottleneck
⭐ Application-security, DevSecOps and platform engineers owning the agent rollout
⭐ Engineering managers and CTOs accountable for velocity and for incidents
⭐ IT auditors and GRC leads who must evidence change control over AI-generated code

Homepage

https://www.udemy.com/course/secure-agentic-software-development-beyond-vibe-coding

Rapidgator
qfond.Secure.Agentic.Software.Development.Beyond.Vibe.Coding.part1.rar.html
qfond.Secure.Agentic.Software.Development.Beyond.Vibe.Coding.part2.rar.html
qfond.Secure.Agentic.Software.Development.Beyond.Vibe.Coding.part3.rar.html
AlfaFile
qfond.Secure.Agentic.Software.Development.Beyond.Vibe.Coding.part1.rar
qfond.Secure.Agentic.Software.Development.Beyond.Vibe.Coding.part2.rar
qfond.Secure.Agentic.Software.Development.Beyond.Vibe.Coding.part3.rar