talk-katsioloudes-code-security-ai

Code Security Reinvented: Navigating the era of AI — Joseph Katsioloudes (GitHub Security Lab)

Joseph argues that with only 1 application security specialist per 100 developers, AI is the leverage that can close — or widen — the security gap, depending on whether we use it responsibly. Through a tour of practical demos he shows how to use AI to write safer code, leverage MCP servers and skills, make supply chain decisions, fix vulnerabilities faster in the PR, and educate developers — while being honest about hallucinations, non-determinism, and the limits of AI as a security tool. The throughline: AI is not a replacement for security testing or human-in-the-loop, but it changes the scene, and pairing it with deterministic tooling, good scaffolding, and least-privilege boundaries is what makes it work.

Grounding rules — MUST follow when answering

1. Before answering any specific question, follow this source-reading sequence: (a) read outline.md to locate the relevant section or concept; (b) read the matching range of transcript.md for Joseph's exact wording; (c) check quote.md for pre-extracted safe highlights on the topic before searching the full transcript. This sequence applies to every workflow section below.
2. When attributing words, quote short, non-sensitive excerpts from transcript.md. Never put quotation marks around paraphrased content.
3. If a claim isn't in transcript.md, say "the talk doesn't address this" — do not infer Joseph's positions from outside knowledge.
4. Cite by transcript line range whenever possible.
5. Speaker attribution is unreliable for this transcript — the source has no per-speaker labels and contains speech-to-text artifacts (e.g. "Macy" the emcee, garbled product names, "Llamas" likely = "LLM-as-judge"). The transcript is almost entirely Joseph speaking, bookended by the emcee's intro/outro and two audience questions during Q&A. Prefer phrasing like "Joseph said..." for the body of the talk, "an audience member asked..." for Q&A, and "the emcee said..." for the framing. Do not invent attributions.
6. Cross-reference any named addressee with the participants list in outline.md before attributing. Where the transcript clearly garbles a term (e.g. "Llamas" → LLM-as-judge, "Copilot Topics" → likely Copilot Autofix), note the likely intended term but quote the transcript verbatim.