How Does Secure Software Start?

Dane Knecht says secure software starts by shrinking the attack surface: fewer places for a vulnerability, simpler software, and less code. Formal verification, safer programming languages, and safer runtimes will come later. Early AI is very verbose, likes to create complexity, and has not been helping Cloudflare build more secure software. He thinks it will get there. Human judgment still has to make sure the design can stand securely.

The work has to be solved at every level, the way humans did before agents. Product engineers need training. Security teams still need checks and balances and a second set of eyes. Cloudflare has been writing its principles down. A document called the Codex gathers many RFCs the teams built: how to build secure software at Cloudflare, how to build available software at Cloudflare, and the best practices. The Codex boils up into 10 commandments that agents follow and use in every part of the review process.

Agents still ride a lot of the slop. Deeper in the factory, people run the performance runs and the security runs. Cloudflare still needs adversarial reviews, just as the company did before agents.