arkoStart with the change you can see.
Generated code can look plausible before its assumptions have been reviewed. Begin with the actual source, its dependencies and the behaviour the change is meant to deliver. Give the agent a clear brief and ask it to explain important design decisions.
Check source and dependencies.
Look for five concrete failure modes:
- Secrets or API keys embedded in source.
- Untrusted input inserted into queries or commands.
- Unsafe deserialisation or tool calls without appropriate checks.
- Personal data passed into model context without an approved purpose and boundary.
- Vulnerable dependencies, including packages introduced indirectly.
Review the task’s intended behaviour, relevant prompt instructions and changed code together. Exclude secrets and unnecessary personal data from that context. When generated changes outpace review capacity, make the checks part of the task rather than relying on a later hand-off. Source checks and dependency checks answer different questions; include both where relevant.
Connect the agent as well as the editor.
If code is being written in an agent session, checks need to be available there. An MCP connection lets the agent call ARKO during the task. The editor extension gives developers another place to inspect findings.
Review the fix, then check again.
A proposed change is a starting point. Understand what it changes, run the application’s normal checks, then ask ARKO to inspect the updated code. When validating a project with existing findings, preserve the full file scope; do not submit only one fixed file while other findings exist elsewhere.
Keep the scope visible.
Record which files or manifests were analysed, whether the checks completed, which findings remain and what was changed. A passing check is evidence about its scope; it is not a guarantee that an application has no vulnerabilities.
Carry the standard across the team.
Agree the policies, review responsibilities and gate behaviour for each connected integration. Bring the outcomes into the enterprise view so developers and assurance teams can discuss the same result.