Nowadays most of our code is opensource, and we use a large amount of it in our systems. But we need to keep an eye on those opensource components, as new vulnerabilities are discovered every day. What happens if we let our guard down? And what can we do to avoid it? In this presentation we take a look at a simple RCE vulnerability, how it can be exploited, sending pure (?) JSON to a server, in order to take control of it, in a live demo. After explaining what's happening, we then take a look at a free plugin to use directly in our IDE to prevent this, giving the power back to developers!

You build applications using Generative AI and LLM frameworks for your JavaScript apps. Hurray! I sure hope you didn’t forget this tiny little thing called application security :-)​Join me in this session, where we uncover imminent security vulnerabilities from basics to hands-on live hacking and demonstrate real-world insecure JavaScript code mistakes as we hack in the IDE and unleash exploit payloads that compromise AI-generated code. You’ll learn and experience prompt injection, LLM agents with excessive access, code vulnerabilities introduced via IDE auto-suggest tools, and how LLM sources turn into an imminent security risk.

Asking an LLM about Svelte 5 doesn't get you much useful information, cut-offs in training data mean that when there's a rapidly changing framework the information can be irrelevant.

Just get the LLM to use the internet, init!? Yeah, I'm going to walk through a set of Model Context Protocol tools I use or have built, how I use them in Claude and Cline and (hopefully) do a one-shot prompt to build out a feature straight from the Svelte blog!

AI’s potential in software development extends far beyond code generation or chatbot-style assistants in the IDE. This talk explores how five families of AI capabilities (Learning & Onboarding, Coding Assistants, Automation & Agents, Planning, and Data Exploration & Synthesis) can transform the entire CI/CD lifecycle.

Whether it’s assessing processes, building pipelines, planning large-scale VM migrations, or summarizing an ocean of information, we’ll talk about how to identify high-impact integration points often untapped by chatbot or IDE based AI integrations. Centering AI integration around developers throughout the entire lifecycle of planning, coding, deployment, and monitoring unlocks greater ROI than simply generating more lines of code.