HN user

JulienZammit

2 karma

AppSec + LLM coding agents. At CybeDefend (Lille, FR) looking at the business-logic gap between SAST scanners and code generated by Claude/Cursor/Copilot.

Posts0
Comments4
View on HN
No posts found.

The "agent-neutral codebase" framing is the right abstraction. We ended up building a small generator that takes a single spec file and emits the agent-specific config (CLAUDE.md, AGENTS.md, .cursor/rules) rather than maintaining symlinks. Easier to version and to add a new agent when they inevitably ship next month.

The pain point you're underselling is hooks. They're the least portable piece by far because each harness has its own event model. Skills port reasonably, subagents mostly port, hooks almost never do.

Related question, does the chapter view help for security review? Code review catches "is this well written", but security review is more like "did the author forget the auth check on this new endpoint, or remove a tenant filter by accident". Those aren't really visible as a chapter since the problem is what's not in the diff. Curious if the authors have thought about that use case or if it's a separate tool entirely.

Claude Design 3 months ago

Been watching the same pattern. The weekly shipping cadence is impressive but I'm skeptical these products get loved in 2 years. Claude Code gets the focus because it drives revenue. Everything else feels like option value for the IPO narrative. Kind of makes me want to build on the API directly rather than on any specific product surface.