Treat LLM as an untrusted execution entity: consider any text from issues, logs, documents, or web pages as untrusted data; first, let AI only perform structured extraction (JSON) without directly writing code; then, based on the JSON and trusted code, have AI output only auditable diffs; all side effects (running tests, modifying files, connecting to the internet) must go through whitelisted tools + sandbox; default to no network access and minimal permissions; enforce manual review for sensitive directories like authentication/wallet/payment; CI should perform high-risk mode and external connection scans, retain diffs and reports, and immediately block and roll back upon detecting high risks. ---claude