The biggest crisis in the software world!

Soner Acar made striking assessments regarding the GitHub-related security breach that has been on the agenda in the technology world in recent days. Following GitHub's announcement that it suffered a data breach due to a malicious VS Code extension on an employee's computer, Acar stated that the real risk is growing in developer environments.

“THE MOST AUTHORIZED YET LEAST AUDITED AREA”

Soner Acar stated that for years, the security approach has progressed with the mindset of “trust the developer, protect the platform,” but that this approach now poses serious risks.

According to Acar, the local computers used by developers are no longer just areas where code is written; they have become hubs where SSH keys, cloud service tokens, and critical credentials that provide access to production environments are stored.

Acar emphasized that numerous third-party software programs that have not undergone security team audits operate with full authority in these systems.

VS CODE EXTENSIONS AND AI TOOLS AT RISK

Stating that the incident at GitHub has once again revealed the fragility in the software supply chain, Soner Acar drew attention specifically to VS Code extensions and AI-based code assistants.

Acar said, “The next stop for the crisis experienced in VS Code extensions today will be AI code assistants and MCP servers.”

Noting that AI tools that run locally and have full access to the file system can also access the internet, Acar said that the supply chain for these structures is largely unaudited.

ARGUED THAT “BE CAREFUL” WARNINGS ARE INSUFFICIENT

Soner Acar stated that merely warning employees is no longer enough, expressing that automated security mechanisms have become mandatory.

Among the security measures Acar highlighted, “pre-commit hook” systems stood out. Stating that these structures should automatically scan sensitive information such as .env files, API keys, and certificates before every action taken by software developers, Acar pointed to the importance of stopping the process immediately when a risk is detected.

CALL FOR RESTRICTIONS ON AI AGENTS

Soner Acar said that special security mechanisms must also be established for AI-powered code assistants.

Stating that system commands and write operations of tools like Claude Code and Codex should be audited with “Agent Hook” mechanisms, Acar noted that sensitive data should be completely blocked from access with configurations similar to .claudeignore.

“CREDENTIALS SHOULD NOT BE KEPT IN LOCAL FILES”

Another topic Acar drew attention to was centralized password management.

Stating that keeping credentials in local files poses a major risk, Soner Acar recommended the use of centralized vaults similar to AWS Secrets Manager.

Acar stated that sensitive information should only be called at runtime.

“DEVELOPMENT ENVIRONMENTS MUST NOW BE PROTECTED LIKE LIVE SYSTEMS”

At the end of his statement, emphasizing that development environments can no longer be protected with classic methods, Soner Acar said that companies must manage their “Dev Environment” structure just like a live system.