“We've made a very strong decision on Open Identity Server at the moment is that no code that gets committed is AI generated. But that's not to say that we're not using AI, because what we use AI for is for checking our work. … We implement the RFC by hand, using traditional software engineering techniques, and then we use AI in order to validate that what we've done matches the RFC.”
The Modern .NET Show · Hands-On Engineering Podcasts · November 2026
Context
Asked how AI and agentic tools fit into building security software, Andy explains his team's policy of hand-written security code with AI as the reviewer, a rule that applies to outside contributors too.
Transcript
…got stolen. You can see it as a human. You probably try and help that person out. So yeah, I mean, SMS is nowhere near as secure as we probably thought it was. And yeah, and the only real true stuff nowadays is passkeys. And that's what we're kind of promoting as well with most of our customers.
…cold face and you are writing things into the systems that everybody uses, you know how people say never write your own cryptographic library because even the PhDs, the people with multiple PhDs who do this get it wrong. Yeah, sure. I can't even imagine what it's like to be in security, you know?
Yeah, and that probably is a pretty good, I mean, one of the things I was kind of going to allude to at one point was, so AI is a massive thing. And, you know, our parent company is pushing AI very hard for us to adopt AI and get better, but get a throughput in terms of what we produce. We've made a very strong decision on Open Identity Server at the moment is that no code that gets committed is AI generated. But that's not to say that we're not using AI because what we use AI for is for checking our work, right? So, you know, we'll build a feature against a spec and plowing through an RFC trying to make sure you've covered every case is a painful process, right? So we often use, we build the implement the RFC, you know, by hand using, you know, traditional software engineering techniques. And then we use AI in order to validate that what we've done matches the RFC. Think that's been very useful, how that second set of eyes. I mean, we've seen that AI has been used all the time for like finding vulnerabilities. And that's how we're trying to use it, not to build the thing, the actual code, but we're actually using it to check our work effectively. And that's been…
Yeah, absolutely. You've answered one of the questions that I was going to sort of come up with. And since, like, you know, everybody seems to be using LLMs, AI, Agentic Development, whatever you want to call it. We're not talking about vibe coding, folks, right? Or at least I'm not talking about…
Yeah, no. And, you know, I think we've heavily embraced the AI side of it, but we, we, like I said, we understand what we think. We still want to own the security side of it and make sure that we architect it and build it correctly and then just use it as that second, is that it's the check.…
Yeah. And again, that kind of makes sense, right? Let's take the opinions of the tech industry and put them to one side, but acknowledge that those opinions exist, right? There are lots of people out there who are saying a machine can't possibly write code as well as a human. Absolutely. We're…
More from The Modern .NET Show
