Vulnerability Jail and the AI-Era AppSec Engineer

Three years ago, Jeevan Singh mapped out what an application security engineer needed to know. AI has rewritten the job since. Jeevan, Director of Security Engineering at Rippling, returns to unpack how his team polices thousands of engineers shipping 10x more code: a "vulnerability jail" that locks non-compliant teams out of the main branch, AI-reviewed extension requests, and homegrown agents that hunt for entire classes of vulnerabilities instead of one bug at a time. He and Chris debate whether AI has killed classic SAST and DAST, whether code review still needs a human in the loop, and whether bug bounty programs still make sense when the researchers on both sides are running the same models. Plus: one concrete move every AppSec leader can make this quarter. This episode is sponsored by Security Compass. Make modern software development secure, consistent, and provable. About Security Compass AI writes code faster than anyone reviews the design. Threats do not wait for an annual assessment. Security Compass models threats continuously and turns them into requirements developers act on, not a report read after ship. → Learn more about securing the AI-DLC with Security Compass This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it. About Corgea Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely. → Learn more about Corgea Connect with Jeevan Singh: → Jeevan Singh on LinkedIn Mentioned in this episode: → Rippling → Dwarkesh Patel: "The Rise and Fall of Agent Civilizations" (essay on the OpenAI–Hugging Face incident) Follow the Application Security Podcast: ➜ Home: appsecpodcast.com ➜ X: @AppSecPodcast ➜ LinkedIn: The Application Security Podcast ➜ YouTube: @ApplicationSecurityPodcast ➜ Instagram: @appsecpodcast ➜ Facebook: Application Security Podcast Chapters: 00:00:00 - Cold open: vulnerability jail 00:00:55 - Meet Jeevan Singh 00:01:11 - Welcome and Robert's AI lab 00:02:37 - What gets Jeevan away from the machines 00:04:51 - Hardware projects with his son 00:06:20 - What's changed for the AppSec engineer since AI 00:08:17 - Shipping production code and fixing whole vulnerability classes 00:09:13 - Why AppSec has to become less collaborative 00:10:02 - From democratized vuln management to vulnerability jail 00:11:50 - How engineering reacted and the feature flag jail precedent 00:14:05 - From manual jail to automated checks 00:15:30 - An AI bot that reviews SLA extensions 00:16:06 - Can AI wipe out an entire vulnerability class? 00:17:36 - Building an anti-SSRF library and rolling it out 00:19:40 - Which AppSec skills matter now 00:22:28 - Validating all that AI-generated code 00:22:57 - Agents that hunt for vulnerability classes 00:24:38 - Is this the death of classic AppSec tools? 00:26:51 - Code review and humans in, on, and out of the loop 00:28:00 - Objective-based agents that find RCEs 00:28:59 - Build vs. buy for AppSec teams 00:31:29 - Advice for teams of one to five AppSec engineers 00:32:58 - Cutting SLAs to 3, 5, 7, and 10 days 00:34:31 - Parachuted in as the only AppSec engineer 00:37:59 - One investment to make this quarter 00:39:09 - The Hugging Face and OpenAI agent incident 00:40:13 - Is bug bounty dead? 00:42:19 - Key takeaways: be an engineer, run toward AI 00:43:53 - Wrap-up