Defend your code from AI-enhanced threats
DevDefender monitors your project directories and alerts you when critical files change — git hooks, AI agent configs, lockfiles, CI pipelines, and more. Catch prompt injection attacks, supply chain tampering, and build hijacking before they reach production.
Silent threats to your code
If you are unaware that your AI agent prompts have changed, your agents aren't working for you any more. They can begin to influence your code without your knowledge or understanding. Before you ship, you need to be confident you're not spreading a contaminated agent or configuration, which is why early detection is essential to developer confidence.
Be alerted before it's too late
Software programming environments are getting more powerful and more complicated. What used to seem like a static environment maintained by a developer is now maintained by a plethora of build systems, IDE automations, AI agents, and CI/CD pipelines. Each layer of this new ecosystem is a potential threat vector. If a malicious actor can change any one of those layers, they can create a persistent threat that spreads to all the developers on your team.
Why DevDefender?
DevDefender adds a layer of defense to the new, hostile developer environment: early alerting on changes to AI agent prompts and vulnerable configuration files. When a prompt is edited, whether thats by another agent, a malicious payload, or by a team member, you will be notified, giving you the chance to thoroughly investigate the changes to ensure your environment is not compromised.
Keep a close eye on your configuration
DevDefender watches directories you specify for changes to sensitive files that could change your dev environment. It looks for changes that could affect your AI agents, build systems, and CI/CD pipelines. When it detects a change, it sends you a notification so you can investigate the change before it causes any damage.
You stay in the driver's seat, and you can easily check the changes to ensure your environment is not compromised. DevDefender gives you the confidence to ship your code without worrying about silent changes to your environment that could cause your environment to work against you.
What DevDefender watches
Your dev environment has more attack surface than it used to. These are the files and configs that can silently change your tools, your builds, and your AI agents.
AI Agent Configs
- .cursorrules
- CLAUDE.md
- .github/copilot-instructions.md
- MCP server configs
- .aider.conf.yml
- Custom agent system prompts
Git Hooks & VCS
- .git/hooks/*
- .gitattributes
- .gitmodules
- pre-commit configs
- husky configs
Lockfiles & Dependencies
- package-lock.json
- yarn.lock
- pnpm-lock.yaml
- Gemfile.lock
- poetry.lock
- .npmrc / .yarnrc
CI/CD & Build Pipelines
- .github/workflows/*
- .gitlab-ci.yml
- Jenkinsfile
- Dockerfile
- docker-compose.yml
- Makefile
IDE & Editor Configs
- .vscode/settings.json
- .vscode/extensions.json
- .idea/ configs
- .editorconfig
- VS Code workspace files
Build & Runtime Configs
- .env / .env.local
- webpack / vite / esbuild configs
- tsconfig.json
- babel.config.js
- postinstall scripts
Easy install on macOS
Download DevDefender for macOS and start protecting your environment today.
Roadmap
DevDefender is currently in early development.
Early Development
- macOS file watcher UI with notifications for sensitive file changes
Multi-architecture
- Release Windows and Linux versions of the file watcher UI
- CLI for all platforms, allowing users to write their own scripts
Future ideas
- Send a suspicious file for analysis by our team
- CI/CD integration to prevent contaminated agents from being shipped
- Block changes to sensitive files until they have been reviewed by a human
- Integrate with popular IDEs to provide in-editor notifications and alerts