Guardsquare vs Veracode

Safeguarding LLM-Assisted Dev at Guardsquare

New blog post discussing Guardsquare's approach to using large language models (LLMs) in development, highlighting security considerations for a cybersecurity company handling sensitive IP.

Use P2C + EWMA for High-Throughput Java Routing

A technical article demonstrating that traditional round-robin load balancing performs poorly for high-concurrency Java virtual thread workloads. The author recommends using the Power-of-Two-Choices (P2C) sampling algorithm combined with an Exponentially Weighted Moving Average (EWMA) latency metric to compute a real-time health score per instance: Score = (Active Virtual Threads + 1) × EWMA Latency. The post includes a Java code snippet implementing a P2C selector and argues this approach reduces p99/p999 tail latency and avoids synchronization costs inherent to full-node scans or naive least-connections strategies.

• Java virtual threads allow microservices to handle ~50,000 concurrent requests per instance (as asserted by the author).
• Legacy round-robin load balancers can degrade p99 latency when servicing virtual-thread workloads due to head-of-line blocking.
• The recommended routing policy is Power-of-Two-Choices (P2C) sampling of two instances plus a health score computed as (Active Virtual Threads + 1) × EWMA Latency.

Community Poll: Do You Test AI Agents for Prompt Injection?

A Dev.to community post by Brij Purswani (published 2026-07-07) asks developers whether they test AI agents for prompt injection and adversarial inputs. The author, who builds security tools for AI agents, reports having spoken with roughly 200 developers and says most admitted they do not test for adversarial prompts. The post lists poll options (A: I test, B: I know I should, C: I didn't know, D: Not sensitive) and links to a quick scan tool (sec-ra.com) for testing agents. The piece is a discussion prompt rather than a technical guide or policy announcement.

• Author Brij Purswani published the post on Dev.to on 2026-07-07.
• The post asks whether developers test AI agents for adversarial inputs such as prompt injection, system prompt extraction, or unauthorized tool/data access.
• The author says he has talked to about 200 developers and that most answered 'no' to testing for adversarial inputs.

Intentional Coding as Alternative to Vibe Coding

The author argues that the informal "vibe coding" approach enabled by generative AI is insufficient for building production systems and proposes "Intentional Coding": a disciplined, methodical approach that embeds security, correctness, testing and lifecycle rigor (FSOP and ITIL-like discipline) at every layer. The piece cites multiple studies and vendor reports (Veracode, METR, CodeRabbit, GitClear) that found AI-generated code often introduces security vulnerabilities, increases bug rates, and can slow experienced developers on mature codebases. The author warns about compliance risks (citing GDPR Article 32) and calls for clearer responsibility boundaries between AI-as-copilot and AI-as-author.

• The article introduces the term "Intentional Coding" as an approach that requires methodical, lifecycle-driven engineering with default good practices (security, accuracy, tests, maintainability) at every layer.
• Veracode (2025 GenAI Code Security Report) found AI-generated code introduced an OWASP Top 10 vulnerability in approximately 45% of tests.
• METR (controlled study, July 2025) reported experienced developers were 19% slower on mature codebases when using AI, despite expecting to be faster.