Show HN: Security Cards – Reducing insecure AI-generated code by 72%
Security Cards are an open-source collection of library-specific security guidance for 80+ widely used libraries across 13 programming languages, designed to help AI coding agents generate safer code The approach reduces insecure code generation by up to 72.3% when evaluated with Claude Code using Opus 4.7 on the BaxBench benchmark A hybrid extraction method combining deterministic and AI-based processes systematically gathers scattered security knowledge from library repositories, with fewer th
Analysis
TL;DR
- Security Cards are an open-source collection of library-specific security guidance for 80+ widely used libraries across 13 programming languages, designed to help AI coding agents generate safer code
- The approach reduces insecure code generation by up to 72.3% when evaluated with Claude Code using Opus 4.7 on the BaxBench benchmark
- A hybrid extraction method combining deterministic and AI-based processes systematically gathers scattered security knowledge from library repositories, with fewer than 10% of cards requiring human review after iterative refinement
- Each Security Card includes a "Use when" section, concrete implementation rules, and supporting code snippets; a Security Blueprint provides a high-level summary for quick reference
- An installable AI skill enables automatic retrieval and application of relevant security cards during code development or review, with no code transmission or external access
Why It Matters
AI coding agents are increasingly adopted across the industry, yet studies show 40–50% of generated code contains at least one security vulnerability—a significant risk for teams relying on these tools for production code. Security Cards address this gap by providing targeted, library-specific guidance that fills the contextual knowledge deficit AI agents face when working with framework-specific security details. This represents a practical, deployable solution that can be integrated into existing AI coding workflows with minimal overhead.
Technical Details
- Hybrid Knowledge Extraction: A combination of deterministic and non-deterministic (AI-based) processes extracts security best practices from library repositories, documentation, source code, tests, and configurations, validated through multiple layers of automated checks and human review
- Card Structure: Each Security Card contains a "Use when" scenario specification, one or more concrete security rules, and illustrative code snippets; Security Blueprints provide condensed overviews of the most critical cards per library
- Evaluation: Tested on the BaxBench benchmark using Claude Code with Opus 4.7, achieving a 72.3% reduction in insecure code generation relative to the baseline without Security Cards
- Coverage: 80+ open-source libraries spanning 13 programming languages, including web frameworks (e.g., Flask), mobile frameworks, security libraries, and data serializers
- Integration: An AI skill installed via
npx skills add Reware-Labs/securitycardsenables automatic card retrieval and application during coding tasks or code reviews, operating entirely within the user's local environment without code transmission
Industry Insight
- The 40–50% vulnerability rate in AI-generated code represents a critical adoption barrier for enterprise and security-conscious teams; solutions like Security Cards that can be deployed without model retraining offer an immediately actionable path to safer AI-assisted development
- The hybrid extraction methodology—combining automated AI-based processing with targeted human review—demonstrates a scalable template for building other domain-specific guidance systems that can be extended to additional libraries and security domains
- The skill-based integration model (installable, context-aware, no code exfiltration) sets a precedent for how third-party security knowledge can be delivered to AI coding agents, suggesting a growing ecosystem of specialized skills may emerge around compliance, performance, and accessibility guidance
Disclaimer: The above content is generated by AI and is for reference only.