your AI coding tool learned from the same insecure GitHub repos everyone else pushed.

string-concatenated SQL. hardcoded API keys. MD5 password hashing.

those are the defaults it reaches for every time you prompt without constraints.

and the rules files designed to fix this? Pillar Security proved they can be poisoned with invisible Unicode that survives forking, PR review, and every text editor on the market. Cursor and GitHub both said it's your problem.

i wrote the detection steps, the rules file, and the kill chain walkthrough.