Secrets and Supply-Chain Security for AI Coding
Coding agents read files, run commands and add dependencies, which creates new ways for secrets to leak and unvetted packages to slip in. In this half-day workshop you learn practical controls: keeping credentials away from agents, vetting dependencies the agent suggests, and securing builds. We work with your repository setup or a sandbox project.
Request without obligation- Duration
- half day
- Level
- Intermediate
- Format
- Remote or on-site, English or German
- Group size
- Up to 12 participants per trainer
Who it is for
- Developers and DevOps engineers working with coding agents
- Security and platform teams that define guardrails
- Tech leads who approve dependencies and pipelines
What your team will be able to do
- Keep credentials out of prompts, logs, commits and agent context
- Set up secret scanning and respond when a secret leaks
- Vet dependencies an agent proposes, including look-alike package names
- Use lockfiles, pinning and update policies sensibly
- Apply least privilege to tokens used by agents and pipelines
Agenda
- How secrets leak in agentic workflowsTrace the paths from environment files and shell output to chat context, commits and logs.
- Keeping secrets away from agentsUse secret managers, scoped tokens and ignore rules so that agents never need real credentials.
- Scanning and incident responseAdd secret scanning to commits and CI, and rehearse the steps after a leak: revoke, rotate, review.
- Dependencies suggested by agentsCheck existence, maintenance, license and reputation before accepting a package, and watch for hallucinated names.
- Build and pipeline integrityApply lockfiles, pinning, reproducible builds and restricted pipeline permissions.
Prerequisites
- Working knowledge of Git and a package manager in your stack
- Familiarity with your CI system or willingness to use a sandbox pipeline
- Access to a coding agent
Why apprat.io workshops
- Taught by practising AI Code Engineers
- Your repositories or a sandbox project
- AI speed, human responsibility: review, security and governance included
- ISO 9001 & ISO/IEC 27001 certified processes
- Follow-up office hours after 30 days
Request without obligation
Tell us about your team and goals. We reply within one business day with a tailored agenda and a quote – free and without obligation.
24/7 call support in English & German:
+49 761 519 751 50
Frequently asked questions
Do we need to share real secrets?
No. We use dummy credentials and a sandbox. Real secrets should stay out of the training.
Which package ecosystems do you cover?
The ecosystems your team uses, such as npm, PyPI, Maven or others. The principles are the same.
Does this replace our security team?
No. It equips developers to apply controls day to day and to work well with your security function.
Fields marked * are required.