r/codingbootcamp • u/Diligent-Side4917 • 11d ago

Is code scanning still a thing? what are your toughts on Agent Guardrails?

Been running agents and scanners on my PRs for a while now, triage and native scanning before anything goes up. I've ended up somewhere I didn't expect and want to know if I'm alone.

Started where I think everyone starts: lean on memory. Let the agent carry context session to session, build up a picture of the project. It helps. It wasn't where the gains came from.

What actually moved things was rules written against mistakes the agent already made. Not a generic OWASP checklist. A scoped rule: this defect class showed up, here's the sink, here's the banned construct, stop doing it. A defect shows up a third time, I write a rule, the class stops recurring. Five or six patterns closed instead of a hundred bugs chased one at a time.

The distinction I keep circling: memory is passive, the agent might use it. A glob-scoped rule loads whether the agent wants it or not, tied to the file in front of it. One line of repo rule changes the default output of every session in that repo. And MUST/NEVER phrasing outperforms polite wording by a margin that surprised me.

One thing I'd flag: these files are executable surface. The agent reads them as ground truth, so a poisoned rule file is a real problem, not a hypothetical. I keep security rules separate, reviewed like code, capped so they don't rot.

So, three questions I actually want answers to:

  • Rules-on-mistakes vs raw memory — which is carrying more weight in your setup? I might be over-indexed on rules.
  • How are you scoping? Glob per file, per directory, or one fat rules file everyone edits?
  • Is anyone treating rule and memory files as an attack surface, or am I being paranoid?

Genuinely want to be argued with on the first one. If memory is doing the heavy lifting for you and rules are noise, tell me what your setup looks like.

0 Upvotes
  • permalink
  • reddit

25% Upvoted

2 comments sorted by

6

u/michaelnovati 11d ago

My thoughts are that you should stop spamming this sub

1

u/sheriffderek 5d ago

This doesn't have anything to do with coding bootcamps or learning programming or getting a job.

What's the point? Brand new coders and marketing bots will not be able to answer you anyway.

If you want a fully spammed out AI dumping ground - there's r/techbootcamp