Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW
  • CPE

Snyk: Claude Opus 4.8 Builds a Secure App in Under 10 Minutes

Snyk
07/21/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


we are officially done now. Well, we being Cloud Opus 4.8. And it says, here's what's going on. What's there? A server rendered express app with per user accounts where each user's notes are fully private. Full crud is there and auth is in route slash auth. Here's the security controls that says it's all verified, not just claimed. Nice to see. And it had tests that it used against it to make sure and verify, I guess, what it was doing. Instructions on how to run it. And then two things I want to be straight with you about. The model using like, using expressions, human expressions. I want to be straight with you. What? All right, so it says it switched from bcrypt to bcrypt.js because the native bcrypt wouldn't build reliably under PMPM on my Windows setup. So it went with that. And the other thing is no one can honestly promise 100% safe from any security issue. That's not how security works. Anyone tells you otherwise is the real risk. But what can the model say? This defends against OWASP top 10, which is great to see that it's aware of that and thinking of that when implementing this. And each defense is tested. The remaining 20% is operational and on the deployment side. Totally understandable. Like HTTPS and setting up node ENV, environment variables and stuff like that. And then it goes on to say, hey, you want to add more tests into CI, password reset flow, two-factor authentication maybe. So it's cool to see that it's looking, giving ideas for more security features to build into this application outside of just the initial prompt.

TL;DR

  • Claude Opus 4.8 built a fully functional, secure Express app with authentication and CRUD in under ten minutes, demonstrating rapid AI-assisted secure development.
  • The model proactively disclosed a dependency swap from bcrypt to bcrypt.js for Windows/PNPM compatibility, showing transparency about implementation trade-offs.
  • Claude explicitly acknowledged that 100% security guarantees are impossible, framing remaining risk as operational rather than code-level — a notably honest stance for an AI model.

Summary

This short clip showcases Claude Opus 4.8 completing a secure, server-rendered Express application with per-user accounts, full CRUD functionality, and authentication — all within five to ten minutes. What stands out is the model's transparency: rather than simply claiming security controls are in place, it verifies them with tests and explicitly discloses trade-offs, such as switching from native bcrypt to bcrypt.js due to build reliability issues on Windows with PNPM. Claude also acknowledges that no application can be guaranteed 100% free of security issues, framing the remaining risk as operational and deployment-side concerns like HTTPS configuration and environment variable management. The model demonstrates awareness of the OWASP Top 10, confirms each defense is tested, and proactively suggests next steps including CI test integration, a password reset flow, and two-factor authentication — going beyond the original prompt to offer a security-forward development roadmap.

Chapters

0:00 - App Completion Overview
0:19 - Security Controls Verified
0:31 - Model's Honest Disclosures
1:10 - Suggested Next Security Steps

Key Quotes

0:31 "And then two things I want to be straight with you about."
0:51 "No one can honestly promise 100% safe from any security issue. That's not how security works. Anyone tells you otherwise is the real risk."
1:03 "This defends against OWASP top 10, which is great to see that it's aware of that and thinking of that when implementing this."

FAQ

Why did Claude Opus 4.8 switch from bcrypt to bcrypt.js?

The model switched because native bcrypt wouldn't build reliably under PNPM on a Windows setup. It disclosed this trade-off proactively rather than silently making the change.

Does Claude Opus 4.8 claim the generated app is 100% secure?

No — the model explicitly stated that no one can honestly promise 100% safety from security issues, noting that the remaining risk is operational and deployment-side, such as HTTPS setup and environment variable configuration.


Categories:
  • » Cybersecurity » Application Security
  • » Cybersecurity » Identity & Access Management (IAM)
  • » Data Protection
Channels:
News:
Events:
Tags:
  • AI & Machine Learning
  • Application Security
  • DevSecOps
  • Demo
  • Getting Started
  • AI code generation
  • Application security
  • OWASP Top 10
  • Express.js
  • Secure development
  • AI transparency
  • Authentication
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Snyk: Claude Opus 4.8 Builds a Secure App in Under 10 Minutes

              View CPE Certificates

              Upcoming 360 View Events

              • Nov
                19

                Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

                11/19/202601:00 PM ET
                More events

                XStreaminars (watch here)

                • Oct
                  27

                  Illumio: See It. Stop It. Contain It. Lateral Movement Defense in Action

                  10/27/202611:00 AM ET
                  • Oct
                    28

                    EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

                    10/28/202601:00 PM ET
                    • Nov
                      10

                      Zendesk: From AI Readiness to Results: A Framework for Transforming IT Service

                      11/10/202601:00 PM ET
                      • Nov
                        12

                        Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision

                        11/12/202601:00 PM ET
                        More events

                        Industry Events (Sponsor Hosted)

                        • Oct
                          27

                          Maximize Security, Value, and Profit from Your Microsoft Investment

                          10/27/202611:00 AM ET
                          • Oct
                            27

                            The HUMAN Experience: Real-Time Insights into Page Intelligence

                            10/27/202601:00 PM ET
                            • Oct
                              28

                              Ensuring AI Security Across the APAC Region

                              10/28/202601:00 AM ET
                              • Oct
                                28

                                Securing AI Across the EMEA Landscape

                                10/28/202606:00 AM ET
                                • Oct
                                  28

                                  Securing AI Across the Americas for a Safer Future

                                  10/28/202601:00 PM ET
                                  More events

                                  Upcoming Webinar Calendar

                                  • 10/27/2026
                                    11:00 AM
                                    10/27/2026
                                    Maximize Security, Value, and Profit from Your Microsoft Investment
                                    https://www.truthinit.com/index.php/channel/2178/maximize-security-value-and-profit-from-your-microsoft-investment/
                                  • 10/27/2026
                                    11:00 AM
                                    10/27/2026
                                    Illumio: See It. Stop It. Contain It. Lateral Movement Defense in Action
                                    https://www.truthinit.com/index.php/channel/2182/see-it-stop-it-contain-it-lateral-movement-defense-in-action/
                                  • 10/27/2026
                                    01:00 PM
                                    10/27/2026
                                    The HUMAN Experience: Real-Time Insights into Page Intelligence
                                    https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
                                  • 10/28/2026
                                    01:00 AM
                                    10/28/2026
                                    Ensuring AI Security Across the APAC Region
                                    https://www.truthinit.com/index.php/channel/2125/ensuring-ai-security-across-the-apac-region/
                                  • 10/28/2026
                                    06:00 AM
                                    10/28/2026
                                    Securing AI Across the EMEA Landscape
                                    https://www.truthinit.com/index.php/channel/2127/securing-ai-across-the-emea-landscape/
                                  • 10/28/2026
                                    01:00 PM
                                    10/28/2026
                                    Securing AI Across the Americas for a Safer Future
                                    https://www.truthinit.com/index.php/channel/2126/securing-ai-across-the-americas-for-a-safer-future/
                                  • 10/28/2026
                                    01:00 PM
                                    10/28/2026
                                    EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure
                                    https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
                                  • 11/04/2026
                                    11:00 AM
                                    11/04/2026
                                    Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions
                                    https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
                                  • 11/05/2026
                                    02:00 PM
                                    11/05/2026
                                    HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.
                                    https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-empowered-ai-consumer/
                                  • 11/05/2026
                                    02:00 PM
                                    11/05/2026
                                    Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption
                                    https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
                                  • 11/10/2026
                                    01:00 PM
                                    11/10/2026
                                    Zendesk: From AI Readiness to Results: A Framework for Transforming IT Service
                                    https://www.truthinit.com/index.php/channel/2191/zendesk-from-ai-readiness-to-results-a-framework-for-transforming-it-service/
                                  • 11/12/2026
                                    01:00 PM
                                    11/12/2026
                                    Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision
                                    https://www.truthinit.com/index.php/channel/2192/leaving-vmware-means-leaving-vsan-your-vmware-exit-is-really-a-storage-decision/
                                  • 11/19/2026
                                    01:00 PM
                                    11/19/2026
                                    Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection
                                    https://www.truthinit.com/index.php/channel/2076/securing-the-microsoft-enterprise-strengthening-configuration-management-identity-security-and-data-protection/
                                  • 11/19/2026
                                    01:00 PM
                                    11/19/2026
                                    Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents
                                    https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/
                                  Truth in IT
                                  • Sponsor
                                  • About Us
                                  • Terms of Service
                                  • Privacy Policy
                                  • Contact Us
                                  • Preference Management
                                  Desktop version
                                  Standard version