Most security tooling gets bolted on after the first incident. A new hire joins, writes a few AI-assisted PRs, and three months later someone notices a hardcoded key in the commit history.

BrassCoders, the scanner that catches what AI assistants structurally miss, changes that timeline. The three-step baseline — install, pre-commit hook, CI gate...