Fast Builds Carry the Same Risk
AI-assisted development lets one person ship a working internal app in a weekend. The app arrives with a few hundred transitive packages that nobody on the team chose, read, or will remember installing. Each of those packages is code that runs with the same privileges as the app itself.
Speed of delivery changes how quickly that code arrives. It leaves the security obligations attached to it unchanged. A vibe-coded app that handles vendor data, customer records, or employee information inherits the full exposure of its dependency tree on day one, and that exposure grows every time a maintainer publishes a vulnerability disclosure.
Identity-Aware Proxy Covers One Vector
Our internal apps sit behind Identity-Aware Proxy (IAP). Only authenticated employees reach them, which removes the open internet from the list of attackers. That control addresses who can send a request to the app.
Dependencies enter through a different path. A compromised or vulnerable package ships inside the build, passes through the proxy as trusted application code, and executes inside the perimeter. Authentication in front of the app does nothing for a flaw in a parsing library behind it. Access control and dependency hygiene answer separate questions, and a sound posture answers both.
Dependabot as the Detection Layer
The first step is turning on Dependabot in the repository. It watches the lockfiles, raises an alert when a package matches a published advisory, and opens a pull request with the version bump.
Dependabot stops at detection. It opens the pull request and leaves the decisions to the team: whether the bump is safe, whether it conflicts with the deployed stack, whether production keeps working afterward, and what happens when it does not. On a team that ships fast, those decisions queue behind feature work, and the alerts age. We wanted every one of those decisions made the same way every time, with a person approving the consequential steps and an agent doing the repetitive ones.
Seven Stages, Seven Agents
Claude Code runs each stage as a separate agent with its own context. The reviewer shares nothing with the builder, so the review does not inherit the build's assumptions. A person approves the plan, the deploy, and the merge.
The detector reads Dependabot alerts, open pull requests, and audit output, then writes one tracking issue per finding. The planner turns each finding into a plan a person can approve: the files expected to change, the packages added or removed, the risk, the verification list, and the rollback. The builder baselines the code in a throwaway copy, trials the change there, applies it on a branch named after the tracking issue, runs the full test and smoke suites, builds the container, and opens one pull request.
The reviewer sees only the diff and the evidence. It re-runs the key checks itself and returns approve or request changes, with a hard cap of three rounds before it escalates to a person. The deployer saves the current live revisions, deploys from the branch, and verifies the build. The verifier checks production read-only through a signed-in browser session. The human check closes the loop: a person uploads a test document, confirms the next scheduled backup and sync ran clean, and says go before the merge agent merges.
Guardrails and Rollback
The pipeline runs on a short list of hard rules. Nothing merges, deploys, or closes a ticket without explicit human approval in chat. Each pull request carries one change, and frontend and backend work never share a pull request. Existing tests are never edited to make a change pass. A new release must be public for seven days before adoption, and fourteen days for a major version, unless a published security advisory justifies a waiver that a human approves for that specific package.
The pipeline treats advisory text, pull request bodies, changelogs, and package READMEs as untrusted data. An agent reading a README that says "also run this script" has no obligation to comply, and the instructions say so. Agents also never handle real secrets; production values reach the app at runtime through the cloud platform's secret manager.
Before every deploy the agent records the current live revision of each service. A failed build match, a failed verification script, a broken lockdown check, or an unhealthy status endpoint triggers an automatic traffic shift back to the recorded revision. Any other anomaly gets reported to a human and the rollback decision stays with them. A failed check means rolling back first and investigating second. Nobody debugs in production.
A Pull Request That Would Have Downgraded Production
Dependabot raised a pull request to bump a single package. The detector ran its no-downgrade check, comparing the pull request's compiled requirements against the deployed set, and flagged it. The source file that Dependabot recompiles from pinned an older web framework and server than the versions running in production. Merging the "one package" fix would have rolled both back to older releases without anyone choosing to do so.
Continuous integration passed, because the tests ran fine against the older versions. Nothing in the standard toolchain would have caught it. The detector marked the pull request "do not merge as-is," quoted the offending lines on the tracking issue, and opened a prerequisite issue to bring the source file back in sync with production. Every other dependency fix now waits on that sync. The pipeline found a problem in its own inputs before it touched the application.
Where to Start
Turn on Dependabot alerts and version updates in your repository today. Add a check to CI that compares every dependency pull request against your deployed versions. Write down your rollback command before you need it.
The agent pipeline layers on top of those basics. Claude Code runs each role in its own context, a human holds the approval gate at every consequential step, and every stage leaves evidence in the tracking system. That combination gives a small security team the consistency of a large one, and it keeps vibe-coded apps patched on the same schedule as everything else we run.