Keep secrets out of prompts and source
Use environment-variable references and secret managers. Do not paste private keys, service-role credentials or production passwords into project instructions.
Security & responsible use
Autonomous coding still needs engineering controls.
Auto-Coder is intended to accelerate development work while keeping review, testing and deployment decisions visible to the user.
Review privileged changes
Authentication, payments, data deletion, infrastructure and permission changes deserve explicit human review before deployment.
Run the real gates
Generated code should pass the same tests, linting, type checks and security review expected from manually written code.
Verify behavior, not just output
A successful command or HTTP 200 does not prove a user flow works. Exercise the interface and error states in a browser.
Recommended operating boundaries
- Use least-privilege credentials for development tools.
- Keep destructive actions confirmable and recoverable.
- Do not allow generated client code to expose server secrets.
- Review dependency additions and lockfile changes.
- Keep backups and version control before broad automated changes.
Reporting a problem
If you find a security or reliability issue in the current Auto-Coder build, use the contact form and select “Security / reliability issue.” Do not include passwords, tokens or private customer data in the message.