AI and AppSec Educator. Secure coding system prompts. https://xitter.cf/t.co/p2rffklf1a
Kauai, HI and Cobb, CA
Joined July 2009
- Tweets45.2K
- Following6.3K
- Followers17.5K
- Likes34.3K
Pinned Tweet
From my experience all software developers are now security engineers wether they know it, admit to it or do it. Your code is now the security of the org you work for. #GoldenAgeOfDefense – at Wat Ket, Thailand
Jim Manico from Manicode Security retweeted
"Black October" is cyber security's version of the "Got Milk" campaign.
Jim Manico from Manicode Security retweeted
@manicode is one of the smartest people at this stuff. If you have a .gov address this is for you!
🇺🇸 Secure Coding for America with AI
FREE live training with me on Claude Code, Codex & secure AI coding.
Nov 16, 2026 · 9 AM–5 PM Eastern · Zoom
For U.S. public-service teams. Official U.S. government email required; registration reviewed.
manicode.com/america.html
🇺🇸 Secure Coding for America with AI
FREE live training with me on Claude Code, Codex & secure AI coding.
Nov 16, 2026 · 9 AM–5 PM Eastern · Zoom
For U.S. public-service teams. Official U.S. government email required; registration reviewed.
manicode.com/america.html
Jim Manico from Manicode Security retweeted
As an industry, cybersecurity shows neither consensus nor an ability to accurately predict the likelihood that adversaries will exploit a given vulnerability, or the impact if they do. This is especially true for the ones labelled ‘critical.’ The culture of guessing is ending. We must aspire to become an industry capable of forecasting exploitation, quantifying impact, and being held to it. The data is available, and the path forward is paved by evidence.
Jim Manico from Manicode Security retweeted
Jim created a great little repo to help reduce supply chain risk in your apps. Thanks!
Check out my little repo at GitHub.com/jmanico/trim-reap… it’s all there for you!
Jim Manico from Manicode Security retweeted
Does anyone remember the time in the 90s when people thought the antivirus vendors were releasing viruses so companies had to buy their products?
Now AI is finding vulnerabilities, writing exploits, and creating threats so fast that the only way to defend yourself is to buy more AI.
It’s starting to feel like the 90s all over again.
Jim Manico from Manicode Security retweeted
These days, patch everything that is reachable/exploitable as fast as you.
OpenAI has given us 11 out-of-cycle usage resets in the last 30 days. That's huge for those of us using Codex and Daybreak Blue for mass security remediation.
I'm still using Anthropic daily, mostly to review and improve Codex's work.
My current multi-model workflow:
* Astra: Builds the initial fix.
* Claude Opus 5.5: Improves the implementation.
* Sol 6.1, Daybreak Blue, and Opus 5.5: Independently review security, correctness, and code quality.
* Astra: Resolves findings, validates, and prepares the final change.
Codex leads the workflow and calls Claude Code CLI when needed.
Multiple models, independent reviews, and automated remediation. This is changing how I approach application security.
OpenAI reset tracking: codex.lunarwerx.com/
This is what #patchThePlanet means to me.
Build agents that assist the patching process. Use them to help prepare updates, test changes, and verify fixes. Patch as much as you can with the resources you have, prioritize the highest risks, and keep getting better at it.
This is basic security hygiene and part of the cost of doing business.
I realize that legacy patching issues can make this painfully difficult to get right. I think it’s worth invest in fixing them so the next round of patching gets easier.
The last manual coding developers standing will be UI developers. Burning tokens to move that image 10 pixels to the left is 🤯.
Most senior security folks are talking negatively about “patch the planet” or “patch everything” strategies.
Meh.
Yes it’s hard but patch everything. It’s painful and expensive especially if you have poor process or tools in the area in the past but patch everything.
You may need more money, staff and tooling but patch everything. As best you can. Right now.
Jim Manico from Manicode Security retweeted
@manicode would you please let everyone know we offer free #cobol education?
IBM.biz/masterthemainframe
Includes free, online, self-paced tutorials in lots of subjects including cobol.
And if your audience wants it, I could 💯 schedule an online live cobol tutorial.
The number of zero days in the back pocket of black hats is likely going up exponentially.
What a time to be alive. The next 12-18 months is going to be extreme!
Jim Manico from Manicode Security retweeted
Reduce your dependencies, reduce your risks. It’s that simple.
Give “Trim Reaper” a try. 😎 The assessment-only prompt inventories your third-party libraries, direct and transitive, and flags which ones you can remove, consolidate, or replace. It’s read-only and won’t touch your code until you approve a plan.
github.com/jmanico/trim-reap…
I’m having really good luck using AI to manage third-party libraries. SCA tells you what’s vulnerable. This tells you what you didn’t need in the first place, which is where a lot of the real risk reduction lives.
Pro tip: run it in Astra or Fable, then have Sol or Opus review the output. Multi-model review ups your game, and crossing vendors is even better.
MIT licensed and free, just to help your cause. This is the kind of work we do at manicode.ai 🤙
Jim Manico from Manicode Security retweeted
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
Readers added context they thought people might want to know
The Tailscale SSH findings require prior authorized access on the tailnet per the researcher's report; Tailscale stated issues concern post-authorization behavior only and did not recommend disabling SSH for everyone.
tailworm.com
x.com/IntCyberDigest…