Why does my AI write code that is correct in isolation but insecure in my system?
Opportunity
AI coding assistants generate code that is syntactically valid and functionally correct at the function level but have no model of the security invariants of the surrounding system: the trust boundaries, IAM policies, data classification, and threat model that make a pattern safe or dangerous in a specific codebase. The result is structurally valid code that exposes tokens in logs, omits row-level access checks, or misconfigures permissions in ways an engineer familiar with the system would catch immediately. CVE-2025-48757 is a concrete case where an AI tool generated database schemas without row-level security, silently exposing 170 production applications. Research shows AI-assisted commits leak secrets at more than twice the rate of human-only commits. No current assistant ingests or reasons about a codebase's existing security model before generating code.
Why it matters
Security context unawareness produces a class of vulnerabilities that pass every syntax check and unit test but are trivially exploitable once deployed.
How I score the opportunity
The Opportunity Score is my own read, not a measurement: how much it hurts, how often it bites, and how little exists to solve it today. Higher means I think it is more worth building.
How much pain it causes when it shows up.
How often people actually run into it.
How little good tooling exists for it today.
More problems worth solving
Why does every AI app forget me the moment I close the tab?
AIWhy is learning a new field still gated by knowing what to ask?
AIWhy can a non-expert not verify what an AI just told them?
AIWhy do we test models on benchmarks but ship them on vibes?
AIWhy do AI agents have no memory of their own mistakes?
AIWhy can't I audit what a model was actually trained on?