DevSecOps Rules Your Ai Coding Agent Cannot Ignore

NEVER commit a secret, key file or credential to version control.

Private keys, certificates, .env files and tokens stay out of git; a secret that was ever committed counts as leaked even after a revert, so rotate it.

NEVER put a secret on a command line or in a file inside the repository.

Shell history, process lists and CI logs capture command lines. Read secrets at runtime from the secret manager or an injected environment that is not checked in.

NEVER print, echo, cat or log a secret, even to debug.

Redact tokens, passwords and keys in every log line and error message. If you must prove a secret is set, print its length or a hash, not the value.

If a secret appears in a log, a chat, a diff, a ticket or a screenshot, treat it as exposed: rotate it first and clean up the exposure second.

Record the rotation in the incident log. Do not argue about whether anyone saw it.

Secrets live only in the approved secret manager (Vault, AWS Secrets Manager, GCP Secret Manager or Azure Key Vault).

Never in Slack, tickets, wikis, spreadsheets, shared drives or committed .env files. Applications fetch secrets at start or via injected environment, and every secret has an owner and a rotation date.

Secret scanning runs on every commit and every pipeline, and NEVER gets bypassed.

Pre-commit hooks and CI jobs that scan for keys (gitleaks, trufflehog or the platform scanner) are part of the definition of done; skipping hooks with --no-verify is not allowed.

Infrastructure changes go through infrastructure as code and a reviewed change; NEVER create or modify cloud resources by hand in a console or with ad-hoc create commands.

Anything built outside code is undocumented, unreviewed and will be destroyed by the next apply.

ALWAYS produce a plan and have it reviewed before an apply, and NEVER auto-approve an apply from a laptop or an agent session.

terraform plan output (or the equivalent preview) is attached to the change; the apply runs from CI after approval.

NEVER run a destroy against a production workspace or stack.

Decommissioning production infrastructure is a planned change with a backup, a rollback and a named approver, not a command.

Infrastructure state is stored remotely, encrypted and locked, and is NEVER edited by hand.

No manual state surgery, no force-unlock without the person who holds the lock, no state files in git.

Pin every provider, module, base image and action to a specific version or digest.

No floating tags: no latest, no unpinned major versions, no branch references in module sources. Upgrades are deliberate changes with a diff, not surprises on the next run.

Every cloud resource carries the required tags: owner, environment, service and cost center.

Untagged resources are rejected by policy checks in the pipeline. Tags are how incidents find an owner and how the bill finds a budget.

Grant the least privilege that does the job and NEVER attach administrator or wildcard policies to a user, role, service account or agent.

Scope every permission to the actions and resources actually used, and expire anything temporary.

No long-lived access keys for people or automation.

Humans use SSO with MFA, workloads use roles or workload identity, CI uses OIDC federation, and anything that must have a static key gets a rotation date under 90 days.

An Ai coding agent runs under its own identity with scoped, expiring, mostly read-only credentials.

NEVER give an agent production admin, a human's personal credentials, or a key that outlives the task. Everything the agent does is attributable to the agent, not to the person who started it.

NEVER make a bucket, object, database, snapshot or queue publicly readable or writable.

Public access blocks stay on at the account level; anything that must be public goes through the CDN with a reviewed change.

NEVER open a security group, firewall rule or network ACL to the whole internet on anything except ports 80 and 443 at the edge.

Administrative ports (SSH, RDP, database ports) are reachable only through the bastion, the VPN or an identity-aware proxy.

MFA is required on every console, source control account, CI system and registry, and the root or owner account is NEVER used for daily work.

Root credentials sit behind hardware keys in a sealed break-glass procedure that is logged and alerted on when used.

Access is reviewed every 90 days and revoked the same day someone leaves or changes role.

Every account, key, token and agent identity has a named owner; ownerless access is removed, not inherited.

Every pipeline runs static analysis, dependency scanning, container scanning and secret scanning, and critical or high findings MUST block the merge.

Findings are fixed or formally accepted with an owner and an expiry date, never silenced in bulk.

NEVER bypass branch protection: no force push to a protected branch, no admin merge over failing checks, no deleting a required check to get green.

If a check is wrong, fix the check in its own reviewed change.

Every change to production ships through a pull request reviewed by a human who did not write it.

Ai agents open pull requests; they NEVER merge them, approve them, or push straight to a deployable branch.

Before touching a live system, take a dated backup, write down the rollback, and after the change verify the thing you changed and one thing you did not.

A change without a known rollback is not ready; a change nobody verified is not done.

No production deploys during a declared freeze, and no deploys outside business hours unless the on-call engineer is awake, informed and able to roll back.

Emergency changes get a ticket within the hour and a review the next business day.

NEVER pipe a download straight into a shell or interpreter, and never install from an unpinned URL.

Download it, read it, verify the checksum or signature, then run it. Lockfiles are committed and dependencies come from the approved registry or mirror.

Containers run as a non-root user from an approved, pinned base image, with no privileged mode, no host network, and no secrets baked into layers.

Images are scanned before they are pushed and rebuilt when the base image patches.

NEVER bind cluster-admin to a workload, a service account or an agent.

Workloads get a namespaced role with the verbs they use; admission policy rejects privileged pods, host mounts and wildcard RBAC.

Destructive actions against a production cluster NEVER run from a laptop or an agent session: deleting namespaces or nodes, draining nodes, scaling to zero, or editing live objects by hand.

Production changes go through the pipeline with a reviewed manifest.

Data is encrypted at rest with managed keys and in transit with TLS 1.2 or newer; TLS 1.0 and 1.1 and plain HTTP endpoints are not allowed anywhere, including internal services and health checks.

Key rotation is automatic and logged.

NEVER copy production data to a laptop, a development environment, an Ai agent's context, or a ticket.

Development and test use masked or synthetic fixtures. Debugging against real data happens in production tooling with audit logging, never by exporting it.

NEVER run DROP, TRUNCATE, or a DELETE or UPDATE without a WHERE clause against a production database from a shell.

Schema and data changes ship as reviewed, reversible migrations with a backup taken first.

Collect only the personal data the product needs, keep it only as long as the retention policy says, and delete it on schedule.

New fields that hold personal or regulated data (health, payment, identity) need a data owner and a retention entry before they ship.

Audit logs (cloud API trails, authentication, admin actions) flow to a central store that is immutable, retained at least one year, and NEVER disabled, even briefly, even to save money.

Turning off a trail is an incident.

Logs never contain secrets, tokens, session identifiers, card numbers, health data or other personal data.

Structured logging with an allow-list of fields beats free-text logging of request bodies. Redaction is tested, not assumed.

Alerts fire, and someone owns them, for: repeated authentication failures, IAM and policy changes, new public exposure, disabled logging, root or break-glass use, and cost spikes.

An alert with no owner is removed; an alert that pages for nothing is tuned the same week.

When something looks like a security incident, declare it immediately with a severity, an incident commander and a communications owner; NEVER wait for certainty and never hide it.

Downgrading a false alarm is cheap; a late declaration is not.

Contain first (rotate credentials, revoke sessions, isolate the host), then preserve evidence: snapshot disks, export logs and record timelines BEFORE remediation.

NEVER wipe, rebuild or terminate a suspected-compromised host until it is imaged.

Every incident gets a blameless postmortem within five business days: timeline, impact, root causes, and tracked action items with owners and dates.

The review targets the system that let the mistake through, never the person who made it.

If an incident may involve personal, health, payment or customer data, notify legal and the privacy owner the same day.

Regulations and contracts start clocks (often 72 hours) from discovery, not from the end of the investigation.

An Ai agent working on infrastructure, data or access MUST call guard_check before any action that is hard to undo and review_work after the work, stop on any deny, and ask a human on any ask.

Agents open changes for review; they never approve, merge or deploy their own work, and they never disable or bypass the guard.