Security-Aware Code Generation and Evaluation
Large Language Models are reshaping software development, but their ability to generate secure code remains an open challenge. SecureCoder is a collaborative research initiative at TU Darmstadt that works on this problem at the level of the model and at the level of the agent: efficient code models built on state space and diffusion architectures, reinforcement learning from verifiable rewards, and security checks built into the loop of coding agents.
Our work brings together expertise in programming languages, natural language processing, and machine learning to produce developer-friendly tools, including a plugin for coding agents such as Claude Code and Codex and a JetBrains IDE plugin, that raise the bar for safe AI-assisted development.
Three lines of work, from the model architecture up to the agent that uses it
We train State Space Models for code, which scale linearly with context length, and Diffusion Language Models, which generate code in parallel and can enforce constraints during generation. We also explore training on data filtered for secure code, so that models learn secure patterns from the start.
Tests, compilers, and static analyzers give a reward signal without human annotation, one that can penalize vulnerable code directly. We develop novel off-policy RLVR algorithms for diffusion language models, with dense, token-level rewards.
We build multi-agent systems in which generator and verifier agents check each other's work, and wire static analysis and CWE knowledge directly into the loop of coding agents, so vulnerabilities are caught and repaired before the code reaches the developer.
Open tools built from our research, ready to use in your workflow
A coding agent that runs inside IntelliJ IDEA and other JetBrains IDEs. Describe a change, and the agent generates the code, checks it with security critics (an LLM reviewer, CodeQL, and a CWE knowledge base), and repairs it before showing you the proposal. Each edit appears as a diff you review and apply yourself; nothing is written until you do. Model, provider, and critics are configurable.
Brings security checks into the loop of coding agents such as Claude Code, Codex, Cursor, and OpenCode, with skills and MCP tools for GitHub Copilot, VS Code, and Kiro. It adds secure-coding constraints to the agent's prompt, scans every edited file with syntax checks, semgrep, and bandit (CodeQL on demand), and guides the agent through fixing and re-checking its findings. All analysis runs locally.
/plugin marketplace add securecoder-project/securecoder-plugin
/plugin install securecoder@securecoder
codex plugin marketplace add securecoder-project/securecoder-plugin
codex plugin add securecoder@securecoder
Research outputs from the SecureCoder project
Loading publications from BibTeX...
Principal investigators and researchers driving the SecureCoder initiative
Programming languages, software engineering, and AI-assisted development with a focus on code correctness and security.
Natural language processing, information extraction, and large language model research for understanding and generating text and code.
Machine learning, statistical relational AI, and deep learning with applications to structured prediction and reasoning.
Questions about our research, tools, or a possible collaboration? Write to us.