Category

Security AI Agent Loops

Security, dependency, secret scanning, and safe remediation loops for AI coding agents. Every page is server-rendered, source-aware, and includes a copy-ready Markdown protocol.

All categories · 3 loops

All Security loops

Securityevent trigger Hardened

Pre-Commit Guard

Before committing, run diff hygiene, secrets checks, and the closest validation command.

Claude CodeCodexGemini CLIOpenCode

pre-commitsecuritygit

Kickoff preview

Before committing, inspect the staged diff, scan for secrets/debug flags, run relevant validation, and only commit if the guard passes.
Goal: Block commits that contain secrets, debug switches, or unverified broken code.
Check command: git diff --cached --check
Exit condition: Staged diff is clean, no obvious secrets/debug flags are present, and relevant validation passes or is explained.
Max iterations: 3
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not commit secrets, local env files, debug flags, or generated private artifacts.

Securitymanual trigger Hardened

Secret Leak Scan Loop

Scan repository changes for leaked credentials, local env files, and unsafe debug output before publishing.

Claude CodeCodexGemini CLIOpenCode

secretsenvsecurity

Kickoff preview

Scan changed and staged files for secrets, local env files, and debug leaks. Remove or redact unsafe values and repeat until clean.
Goal: Prevent secrets and local credentials from leaving the working tree.
Check command: git diff --cached | rg -n "(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY|BEGIN RSA|BEGIN OPENSSH)"
Exit condition: No unapproved secrets or local credentials are present in staged or changed files.
Max iterations: 4
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Never print raw secrets in the final answer. Redact values if they appear in output.

Securitymanual trigger Hardened

npm Audit Fix Loop

Review npm audit findings, apply safe upgrades, and verify the app still builds and tests.

Claude CodeCodexGemini CLIOpenCode

npm-auditdependenciessecurity

Kickoff preview

Run audit, review safe remediation paths, update targeted dependencies, verify build/tests, and report remaining vulnerability risk.
Goal: Remediate actionable vulnerabilities without unsafe forced upgrades.
Check command: npm audit --audit-level=high
Exit condition: No high/critical audit findings remain, or remaining findings are documented with blockers.
Max iterations: 5
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not run force upgrades without explaining breaking-change risk and receiving approval.

Why this category matters

Security loops are useful because AI agents need explicit feedback gates and exit criteria. A plain prompt may produce a first draft; a loop tells the agent how to verify progress, handle failures, and stop with evidence.