Death by small bugs: securing code in the Vulnpocalypse, with Patrick Collins and Simon Harloff

The frontier models that refuse to help you hack your own software are, paradoxically, making you less safe—while open weights models like DeepSeek Flash V4.1 will comply, cost a tenth as much as GPT-6, and find more vulnerabilities in the process. Patrick Collins and Simon Harloff from Dam Secure join Yaniv to explain why agent-built code needs typed languages, why PR gating has flipped from taboo to essential, and how compliance frameworks like SOC 2 are lagging years behind actual threats. They name specific red teaming tools, model providers, and infrastructure choices, and lay out a three-stage security factory that slots into automated software pipelines without slowing human engineers down.

• Open weights models like DeepSeek will comply with requests to find exploits that frontier models refuse, making them essential for defence even as they raise attacker capability.
• DeepSeek Flash V4.1 outperforms GPT-6 on Dam Secure's benchmark of 80 repositories at roughly one-tenth the cost, though it generates more false positives that need filtering.
• Switching from JavaScript or PHP to TypeScript—or any typed language—dramatically improves both LLM reasoning quality and security posture, with teams now auto-migrating codebases via agents running 40–100 hours unattended.
• Modern threat models require always-on automated red teaming rather than annual pen tests; specialist vendors include Harmony Intelligence, Shinobi, and Expo, with PromptFu for LLM-specific attacks.
• The best defensive setup chains tools together: linting guardrails during implementation, security review at PR time, and active exploitation attempts against findings via red teaming software.
• PR gating is now accepted because it blocks agents, not humans, and auto-approval of low-risk PRs is emerging—but compliance auditors still require human batch review every one to two weeks.
• Citizen coders using tools like Lovable or Base44 should treat output as prototype-only and have a skilled engineer review before production; unauthenticated routes and missing RLS policies are common failures.

• 00:00 Opening: Fight Fire with Fire
• 03:09 Open Source Vulnerabilities Accelerating
• 04:20 Burn the Bug Backlog
• 06:49 Typed Languages, No Exceptions
• 08:14 Infrastructure Choices
• 12:02 Always-On Red Teaming
• 16:08 The DeepSeek Advantage
• 19:15 Quantization and Provider Quality
• 26:12 Cutting Noise with Verification
• 29:36 Security in the Software Factory
• 34:12 PR Gating and Auto-Approval
• 37:42 Compliance vs Real Security
• 42:15 Actionable Advice by Role

• DeepSeek: https://www.deepseek.com
• Vercel: https://vercel.com
• Cloudflare: https://www.cloudflare.com
• Supabase: https://supabase.com
• Railway: https://railway.app
• OpenRouter: https://openrouter.ai
• Harmony Intelligence: https://harmonyintelligence.com
• Expo: https://expo.dev
• PromptFu: https://promptfu.com
• Lovable: https://lovable.dev
• GitHub: https://github.com

Patrick Collins and Simon Harloff are the founders of Dam Secure, a code security platform for AI-first engineering teams that builds adversarial agents to find vulnerabilities and runs model evaluations across 80 repositories to determine which LLMs are best at security review.

This episode is presented by SparkLaunch and Dam Secure.

• SparkLaunch (https://sparklaunch.io/wizardry): Applied Wizardry listeners get an extra 20% off.
• Dam Secure (https://damsecure.ai/wizardry): Applied Wizardry listeners get their first month free.

• Justin McArthur, Executive Producer and Video Editor: https://www.linkedin.com/in/justin-mcarthur/
• Steph Hefferan, Editor: https://www.linkedin.com/in/steph-heff/